claudemesh-cli 1.21.1 → 1.22.1

package/dist/entrypoints/cli.js

@@ -88,7 +88,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.21.1", env;
+var URLS, VERSION = "1.22.1", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -6834,6 +6834,154 @@ var init_peers = __esm(() => {
   };
 });
 
+// src/daemon/paths.ts
+import { join as join6 } from "node:path";
+var DAEMON_PATHS, DAEMON_TCP_HOST = "127.0.0.1", DAEMON_TCP_DEFAULT_PORT = 47823;
+var init_paths2 = __esm(() => {
+  init_paths();
+  DAEMON_PATHS = {
+    get DAEMON_DIR() {
+      return join6(PATHS.CONFIG_DIR, "daemon");
+    },
+    get PID_FILE() {
+      return join6(this.DAEMON_DIR, "daemon.pid");
+    },
+    get SOCK_FILE() {
+      return join6(this.DAEMON_DIR, "daemon.sock");
+    },
+    get TOKEN_FILE() {
+      return join6(this.DAEMON_DIR, "local-token");
+    },
+    get OUTBOX_DB() {
+      return join6(this.DAEMON_DIR, "outbox.db");
+    },
+    get INBOX_DB() {
+      return join6(this.DAEMON_DIR, "inbox.db");
+    },
+    get LOG_FILE() {
+      return join6(this.DAEMON_DIR, "daemon.log");
+    }
+  };
+});
+
+// src/daemon/local-token.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname3 } from "node:path";
+import { randomBytes as randomBytes4 } from "node:crypto";
+function readLocalToken() {
+  try {
+    return readFileSync5(DAEMON_PATHS.TOKEN_FILE, "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+function ensureLocalToken() {
+  const existing = readLocalToken();
+  if (existing)
+    return existing;
+  mkdirSync4(dirname3(DAEMON_PATHS.TOKEN_FILE), { recursive: true, mode: 448 });
+  const tok = randomBytes4(32).toString("base64url");
+  writeFileSync6(DAEMON_PATHS.TOKEN_FILE, tok + `
+`, { mode: 384 });
+  return tok;
+}
+var init_local_token = __esm(() => {
+  init_paths2();
+});
+
+// src/daemon/ipc/client.ts
+import { request as httpRequest } from "node:http";
+async function ipc(opts) {
+  const useTcp = !!opts.preferTcp;
+  const headers = {
+    accept: "application/json",
+    host: "localhost"
+  };
+  let bodyBuf;
+  if (opts.body !== undefined) {
+    bodyBuf = Buffer.from(JSON.stringify(opts.body), "utf8");
+    headers["content-type"] = "application/json";
+    headers["content-length"] = String(bodyBuf.length);
+  }
+  if (useTcp) {
+    const tok = readLocalToken();
+    if (!tok)
+      throw new IpcError(0, null, "daemon local token not found; is the daemon running?");
+    headers.authorization = `Bearer ${tok}`;
+  }
+  return new Promise((resolve, reject) => {
+    const req = httpRequest(useTcp ? { host: DAEMON_TCP_HOST, port: DAEMON_TCP_DEFAULT_PORT, path: opts.path, method: opts.method ?? "GET", headers } : { socketPath: DAEMON_PATHS.SOCK_FILE, path: opts.path, method: opts.method ?? "GET", headers }, (res) => {
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => {
+        const raw = Buffer.concat(chunks).toString("utf8");
+        let parsed = raw;
+        try {
+          parsed = raw.length > 0 ? JSON.parse(raw) : null;
+        } catch {}
+        resolve({ status: res.statusCode ?? 0, body: parsed });
+      });
+    });
+    req.setTimeout(opts.timeoutMs ?? 5000, () => req.destroy(new Error("ipc_timeout")));
+    req.on("error", (err) => reject(err));
+    if (bodyBuf)
+      req.write(bodyBuf);
+    req.end();
+  });
+}
+var IpcError;
+var init_client4 = __esm(() => {
+  init_paths2();
+  init_local_token();
+  IpcError = class IpcError extends Error {
+    status;
+    payload;
+    constructor(status, payload, msg) {
+      super(msg);
+      this.status = status;
+      this.payload = payload;
+    }
+  };
+});
+
+// src/services/bridge/daemon-route.ts
+import { existsSync as existsSync7 } from "node:fs";
+async function trySendViaDaemon(args) {
+  if (!existsSync7(DAEMON_PATHS.SOCK_FILE))
+    return null;
+  try {
+    const res = await ipc({
+      method: "POST",
+      path: "/v1/send",
+      timeoutMs: 3000,
+      body: {
+        to: args.to,
+        message: args.message,
+        priority: args.priority,
+        ...args.idempotencyKey ? { client_message_id: args.idempotencyKey } : {}
+      }
+    });
+    if (res.status === 202 || res.status === 200) {
+      return {
+        ok: true,
+        messageId: res.body.broker_message_id ?? res.body.client_message_id ?? "",
+        duplicate: res.body.duplicate,
+        status: res.body.status
+      };
+    }
+    return { ok: false, error: res.body.error ?? `daemon http ${res.status}` };
+  } catch (err) {
+    const msg = String(err);
+    if (/ENOENT|ECONNREFUSED|ipc_timeout/.test(msg))
+      return null;
+    return { ok: false, error: msg };
+  }
+}
+var init_daemon_route = __esm(() => {
+  init_client4();
+  init_paths2();
+});
+
 // src/commands/send.ts
 var exports_send = {};
 __export(exports_send, {
@@ -6855,6 +7003,23 @@ async function runSend(flags, to, message) {
       process.exit(1);
     }
   }
+  {
+    const dr = await trySendViaDaemon({ to, message, priority, expectedMesh: meshSlug ?? undefined });
+    if (dr !== null) {
+      if (dr.ok) {
+        if (flags.json)
+          console.log(JSON.stringify({ ok: true, messageId: dr.messageId, target: to, via: "daemon", duplicate: !!dr.duplicate }));
+        else
+          render.ok(`sent to ${to} (daemon)`, dr.messageId ? dim(dr.messageId.slice(0, 8)) : undefined);
+        return;
+      }
+      if (flags.json)
+        console.log(JSON.stringify({ ok: false, error: dr.error, via: "daemon" }));
+      else
+        render.err(`send failed (daemon): ${dr.error}`);
+      process.exit(1);
+    }
+  }
   if (meshSlug) {
     const bridged = await tryBridge(meshSlug, "send", { to, message, priority });
     if (bridged !== null) {
@@ -6918,6 +7083,7 @@ var init_send = __esm(() => {
   init_connect();
   init_facade();
   init_client3();
+  init_daemon_route();
   init_render();
   init_styles();
 });
@@ -8001,180 +8167,2331 @@ async function runRemind(flags, positional) {
         console.log(JSON.stringify(scheduled, null, 2));
         return;
       }
-      if (scheduled.length === 0) {
-        render.info(dim("No pending reminders."));
-        return;
+      if (scheduled.length === 0) {
+        render.info(dim("No pending reminders."));
+        return;
+      }
+      render.section(`reminders (${scheduled.length})`);
+      for (const m of scheduled) {
+        const when = new Date(m.deliverAt).toLocaleString();
+        const to = m.to === client.getSessionPubkey() ? dim("(self)") : m.to;
+        process.stdout.write(`  ${bold(m.id.slice(0, 8))} ${dim("→")} ${to} ${dim("at")} ${when}
+`);
+        process.stdout.write(`    ${dim(m.message.slice(0, 80))}
+
+`);
+      }
+    });
+    return;
+  }
+  if (action === "cancel") {
+    const id = positional[1];
+    if (!id) {
+      render.err("Usage: claudemesh remind cancel <id>");
+      process.exit(1);
+    }
+    await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+      const ok = await client.cancelScheduled(id);
+      if (ok)
+        render.ok(`cancelled ${bold(id.slice(0, 8))}`);
+      else {
+        render.err(`not found or already fired: ${id}`);
+        process.exit(1);
+      }
+    });
+    return;
+  }
+  const message = action ?? positional.join(" ");
+  if (!message) {
+    render.err("Usage: claudemesh remind <message> --in <duration>");
+    render.info(dim("       claudemesh remind <message> --at <time>"));
+    render.info(dim('       claudemesh remind <message> --cron "0 */2 * * *"'));
+    render.info(dim("       claudemesh remind list"));
+    render.info(dim("       claudemesh remind cancel <id>"));
+    process.exit(1);
+  }
+  const isCron = !!flags.cron;
+  const deliverAt = isCron ? 0 : parseDeliverAt(flags);
+  if (!isCron && deliverAt === null) {
+    render.err("Specify when", 'use --in <duration> (e.g. "2h", "30m"), --at <time> (e.g. "15:00"), or --cron <expression>');
+    process.exit(1);
+  }
+  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+    let targetSpec;
+    if (flags.to && flags.to !== "self") {
+      if (flags.to.startsWith("@") || flags.to === "*" || /^[0-9a-f]{64}$/i.test(flags.to)) {
+        targetSpec = flags.to;
+      } else {
+        const peers = await client.listPeers();
+        const match = peers.find((p) => p.displayName.toLowerCase() === flags.to.toLowerCase());
+        if (!match) {
+          render.err(`Peer "${flags.to}" not found`, `online: ${peers.map((p) => p.displayName).join(", ") || "(none)"}`);
+          process.exit(1);
+        }
+        targetSpec = match.pubkey;
+      }
+    } else {
+      targetSpec = client.getSessionPubkey() ?? "*";
+    }
+    const result = await client.scheduleMessage(targetSpec, message, deliverAt ?? 0, false, flags.cron);
+    if (!result) {
+      render.err("Broker did not acknowledge — check connection");
+      process.exit(1);
+    }
+    if (flags.json) {
+      console.log(JSON.stringify(result));
+      return;
+    }
+    const toLabel = !flags.to || flags.to === "self" ? "yourself" : flags.to;
+    if (isCron) {
+      const nextFire = new Date(result.deliverAt).toLocaleString();
+      render.ok(`recurring reminder set`, `${result.scheduledId.slice(0, 8)}  ·  ${clay(message)} → ${toLabel}  ·  cron ${flags.cron}  ·  next ${nextFire}`);
+    } else {
+      const when = new Date(result.deliverAt).toLocaleString();
+      render.ok(`reminder set`, `${result.scheduledId.slice(0, 8)}  ·  ${clay(message)} → ${toLabel} at ${when}`);
+    }
+  });
+}
+var init_remind = __esm(() => {
+  init_connect();
+  init_render();
+  init_styles();
+});
+
+// src/commands/register.ts
+var exports_register = {};
+__export(exports_register, {
+  register: () => register2
+});
+async function register2() {
+  return login();
+}
+var init_register = __esm(() => {
+  init_login();
+});
+
+// src/commands/logout.ts
+var exports_logout = {};
+__export(exports_logout, {
+  logout: () => logout2
+});
+async function logout2() {
+  try {
+    const { revoked } = await logout();
+    if (revoked) {
+      console.log(`  ${green(icons.check)} Revoked session on claudemesh.com`);
+    } else {
+      console.log(`  ${yellow(icons.warn)} Could not revoke session on claudemesh.com.`);
+      console.log(`    Revoke manually at https://claudemesh.com/dashboard/settings/sessions`);
+    }
+    console.log(`  ${green(icons.check)} Removed local credentials.`);
+    return EXIT.SUCCESS;
+  } catch (err) {
+    console.error(`  ${icons.cross} Logout failed: ${err instanceof Error ? err.message : err}`);
+    return EXIT.AUTH_FAILED;
+  }
+}
+var init_logout = __esm(() => {
+  init_facade6();
+  init_styles();
+  init_exit_codes();
+});
+
+// src/commands/whoami.ts
+var exports_whoami = {};
+__export(exports_whoami, {
+  whoami: () => whoami
+});
+async function whoami(opts) {
+  const result = await whoAmI();
+  if (opts.json) {
+    console.log(JSON.stringify({ schema_version: "1.0", ...result }, null, 2));
+    return result.signed_in || result.local ? EXIT.SUCCESS : EXIT.AUTH_FAILED;
+  }
+  if (!result.signed_in && !result.local) {
+    render.err("Not signed in", "Run `claudemesh login` to sign in or `claudemesh <invite>` to join.");
+    return EXIT.AUTH_FAILED;
+  }
+  render.section("whoami");
+  if (result.signed_in) {
+    render.kv([
+      ["user", `${bold(result.user.display_name)} ${dim(`(${result.user.email})`)}`],
+      ["token", `${result.token_source} ${dim("(~/.claudemesh/auth.json)")}`],
+      ...result.meshes ? [["meshes", `${result.meshes.owned} owned · ${result.meshes.guest} guest`]] : []
+    ]);
+  } else {
+    render.kv([
+      ["web", dim("not signed in · run `claudemesh login` for account features")]
+    ]);
+  }
+  if (result.local) {
+    render.blank();
+    render.kv([
+      ["local", `${result.local.meshes.length} mesh${result.local.meshes.length === 1 ? "" : "es"} · ${dim(result.local.config_path)}`]
+    ]);
+    for (const m of result.local.meshes) {
+      console.log(`    ${clay("●")} ${bold(m.slug)}  ${dim(`member ${m.member_id.slice(0, 8)}…  pk ${m.pubkey_prefix}…`)}`);
+    }
+  }
+  render.blank();
+  return EXIT.SUCCESS;
+}
+var init_whoami = __esm(() => {
+  init_facade6();
+  init_render();
+  init_styles();
+  init_exit_codes();
+});
+
+// src/daemon/lock.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname4 } from "node:path";
+function acquireSingletonLock() {
+  mkdirSync5(dirname4(DAEMON_PATHS.PID_FILE), { recursive: true, mode: 448 });
+  if (existsSync8(DAEMON_PATHS.PID_FILE)) {
+    const raw = readFileSync6(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const oldPid = Number.parseInt(raw, 10);
+    if (Number.isFinite(oldPid) && oldPid > 0 && isProcessAlive(oldPid)) {
+      return { result: "already-running", pid: oldPid };
+    }
+    try {
+      unlinkSync2(DAEMON_PATHS.PID_FILE);
+    } catch {}
+    writeFileSync7(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+    return { result: "stale", pid: process.pid };
+  }
+  writeFileSync7(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+  return { result: "acquired", pid: process.pid };
+}
+function releaseSingletonLock() {
+  try {
+    const raw = readFileSync6(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    if (Number.parseInt(raw, 10) === process.pid)
+      unlinkSync2(DAEMON_PATHS.PID_FILE);
+  } catch {}
+}
+function readRunningPid() {
+  try {
+    const raw = readFileSync6(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const pid = Number.parseInt(raw, 10);
+    if (Number.isFinite(pid) && pid > 0 && isProcessAlive(pid))
+      return pid;
+  } catch {}
+  return null;
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+var init_lock = __esm(() => {
+  init_paths2();
+});
+
+// src/daemon/db/outbox.ts
+function migrateOutbox(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS outbox (
+      id                  TEXT PRIMARY KEY,
+      client_message_id   TEXT NOT NULL UNIQUE,
+      request_fingerprint BLOB NOT NULL,
+      payload             BLOB NOT NULL,
+      enqueued_at         INTEGER NOT NULL,
+      attempts            INTEGER NOT NULL DEFAULT 0,
+      next_attempt_at     INTEGER NOT NULL,
+      status              TEXT NOT NULL CHECK(status IN
+                            ('pending','inflight','done','dead','aborted')),
+      last_error          TEXT,
+      delivered_at        INTEGER,
+      broker_message_id   TEXT,
+      aborted_at          INTEGER,
+      aborted_by          TEXT,
+      superseded_by       TEXT
+    );
+    CREATE INDEX IF NOT EXISTS outbox_pending
+      ON outbox(status, next_attempt_at);
+    CREATE INDEX IF NOT EXISTS outbox_aborted
+      ON outbox(status, aborted_at) WHERE status = 'aborted';
+  `);
+}
+function findByClientId(db, clientMessageId) {
+  const row = db.prepare(`
+    SELECT id, client_message_id, request_fingerprint, payload, enqueued_at,
+           attempts, next_attempt_at, status, last_error, delivered_at,
+           broker_message_id, aborted_at, aborted_by, superseded_by
+      FROM outbox WHERE client_message_id = ?
+  `).get(clientMessageId);
+  return row ?? null;
+}
+function insertPending(db, input) {
+  db.prepare(`
+    INSERT INTO outbox (
+      id, client_message_id, request_fingerprint, payload,
+      enqueued_at, attempts, next_attempt_at, status
+    ) VALUES (?, ?, ?, ?, ?, 0, ?, 'pending')
+  `).run(input.id, input.client_message_id, input.request_fingerprint, input.payload, input.now, input.now);
+}
+function fingerprintsEqual(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function listOutbox(db, p = {}) {
+  const where = [];
+  const args = [];
+  if (p.status) {
+    where.push("status = ?");
+    args.push(p.status);
+  }
+  const sql = `
+    SELECT id, client_message_id, request_fingerprint, payload, enqueued_at,
+           attempts, next_attempt_at, status, last_error, delivered_at,
+           broker_message_id, aborted_at, aborted_by, superseded_by
+      FROM outbox
+     ${where.length ? "WHERE " + where.join(" AND ") : ""}
+     ORDER BY enqueued_at DESC
+     LIMIT ?
+  `;
+  args.push(Math.min(Math.max(p.limit ?? 50, 1), 500));
+  return db.prepare(sql).all(...args);
+}
+function findById(db, id) {
+  return db.prepare(`
+    SELECT id, client_message_id, request_fingerprint, payload, enqueued_at,
+           attempts, next_attempt_at, status, last_error, delivered_at,
+           broker_message_id, aborted_at, aborted_by, superseded_by
+      FROM outbox WHERE id = ?
+  `).get(id) ?? null;
+}
+function requeueDeadOrPending(db, args) {
+  const existing = findById(db, args.id);
+  if (!existing)
+    return null;
+  if (existing.status === "aborted" || existing.status === "done")
+    return null;
+  db.prepare(`
+    UPDATE outbox
+       SET status = 'aborted', aborted_at = ?, aborted_by = ?, superseded_by = ?
+     WHERE id = ? AND status IN ('pending','inflight','dead')
+  `).run(args.now, args.abortedBy, args.newRowId, args.id);
+  db.prepare(`
+    INSERT INTO outbox (
+      id, client_message_id, request_fingerprint, payload,
+      enqueued_at, attempts, next_attempt_at, status
+    ) VALUES (?, ?, ?, ?, ?, 0, ?, 'pending')
+  `).run(args.newRowId, args.newClientMessageId, existing.request_fingerprint, existing.payload, args.now, args.now);
+  return {
+    abortedRowId: existing.id,
+    newRowId: args.newRowId,
+    newClientMessageId: args.newClientMessageId
+  };
+}
+
+// src/daemon/db/sqlite.ts
+async function loadSqlite() {
+  if (cached)
+    return cached;
+  try {
+    const mod = await import("node:sqlite");
+    cached = mod.DatabaseSync;
+    return cached;
+  } catch (nodeErr) {
+    try {
+      const bunMod = await import("bun:sqlite");
+      cached = bunMod.Database;
+      return cached;
+    } catch {
+      const msg = `claudemesh daemon requires Node.js 22.5+ for the embedded SQLite store (node:sqlite), or Bun (bun:sqlite) for dev. Current: ${process.version}. Original error: ${String(nodeErr)}`;
+      throw new Error(msg);
+    }
+  }
+}
+async function openSqlite(path) {
+  const Database = await loadSqlite();
+  const db = new Database(path);
+  db.exec(`
+    PRAGMA journal_mode = WAL;
+    PRAGMA synchronous = NORMAL;
+    PRAGMA foreign_keys = ON;
+    PRAGMA busy_timeout = 5000;
+  `);
+  return db;
+}
+function inImmediateTx(db, fn) {
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    const out = fn();
+    db.exec("COMMIT");
+    return out;
+  } catch (err) {
+    try {
+      db.exec("ROLLBACK");
+    } catch {}
+    throw err;
+  }
+}
+var cached = null;
+
+// src/daemon/fingerprint.ts
+import { createHash } from "node:crypto";
+function computeRequestFingerprint(req) {
+  const h = createHash("sha256");
+  h.update(String(req.envelope_version), "utf8");
+  h.update(NUL);
+  h.update(req.destination_kind, "utf8");
+  h.update(NUL);
+  h.update(req.destination_ref, "utf8");
+  h.update(NUL);
+  h.update(req.reply_to_id ?? "", "utf8");
+  h.update(NUL);
+  h.update(req.priority, "utf8");
+  h.update(NUL);
+  h.update(req.meta ? canonicalJson(req.meta) : "", "utf8");
+  h.update(NUL);
+  h.update(createHash("sha256").update(req.body).digest());
+  return h.digest();
+}
+function canonicalJson(value) {
+  return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+  if (Array.isArray(value))
+    return value.map(sortKeys);
+  if (value !== null && typeof value === "object") {
+    const obj = value;
+    const out = {};
+    for (const k of Object.keys(obj).sort())
+      out[k] = sortKeys(obj[k]);
+    return out;
+  }
+  return value;
+}
+function fingerprintHexPrefix(fp, bytes = 8) {
+  let s = "";
+  for (let i = 0;i < bytes && i < fp.length; i++) {
+    s += fp[i].toString(16).padStart(2, "0");
+  }
+  return s;
+}
+var NUL;
+var init_fingerprint = __esm(() => {
+  NUL = Buffer.from([0]);
+});
+
+// src/daemon/ipc/handlers/send.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+function acceptSend(req, deps) {
+  const now = (deps.now ?? Date.now)();
+  const newId = deps.newId ?? randomUUID3;
+  const clientId = req.client_message_id?.trim() || ulidLike(newId);
+  const body = Buffer.from(req.message, "utf8");
+  const fingerprint = computeRequestFingerprint({
+    envelope_version: ENVELOPE_VERSION,
+    destination_kind: req.destination_kind,
+    destination_ref: req.destination_ref,
+    reply_to_id: req.reply_to_id ?? null,
+    priority: req.priority ?? "next",
+    meta: req.meta ?? null,
+    body
+  });
+  return inImmediateTx(deps.db, () => {
+    const existing = findByClientId(deps.db, clientId);
+    if (!existing) {
+      insertPending(deps.db, {
+        id: newId(),
+        client_message_id: clientId,
+        request_fingerprint: fingerprint,
+        payload: body,
+        now
+      });
+      return { kind: "accepted_pending", status: 202, client_message_id: clientId };
+    }
+    return decideForExistingRow(existing, fingerprint);
+  });
+}
+function decideForExistingRow(row, fp) {
+  const match = fingerprintsEqual(fp, row.request_fingerprint);
+  const fpPrefix = fingerprintHexPrefix(fp);
+  switch (row.status) {
+    case "pending":
+      return match ? { kind: "accepted_pending", status: 202, client_message_id: row.client_message_id } : conflict("outbox_pending_fingerprint_mismatch", fpPrefix);
+    case "inflight":
+      return match ? { kind: "accepted_inflight", status: 202, client_message_id: row.client_message_id } : conflict("outbox_inflight_fingerprint_mismatch", fpPrefix);
+    case "done":
+      return match ? {
+        kind: "accepted_done",
+        status: 200,
+        client_message_id: row.client_message_id,
+        broker_message_id: row.broker_message_id
+      } : conflict("outbox_done_fingerprint_mismatch", fpPrefix, row.broker_message_id);
+    case "dead":
+      return match ? conflict("outbox_dead_fingerprint_match", fpPrefix, row.broker_message_id) : conflict("outbox_dead_fingerprint_mismatch", fpPrefix);
+    case "aborted":
+      return match ? conflict("outbox_aborted_fingerprint_match", fpPrefix) : conflict("outbox_aborted_fingerprint_mismatch", fpPrefix);
+    default: {
+      const _ = row.status;
+      throw new Error(`unknown outbox status: ${String(_)}`);
+    }
+  }
+}
+function conflict(reason, fpPrefix, brokerMessageId = null) {
+  return {
+    kind: "conflict",
+    status: 409,
+    reason,
+    daemon_fingerprint_prefix: fpPrefix,
+    broker_message_id: brokerMessageId
+  };
+}
+function ulidLike(newId) {
+  return newId();
+}
+var ENVELOPE_VERSION = 1;
+var init_send2 = __esm(() => {
+  init_fingerprint();
+});
+
+// src/daemon/db/inbox.ts
+function migrateInbox(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS inbox (
+      id                  TEXT PRIMARY KEY,
+      client_message_id   TEXT NOT NULL UNIQUE,
+      broker_message_id   TEXT,
+      mesh                TEXT NOT NULL,
+      topic               TEXT,
+      sender_pubkey       TEXT NOT NULL,
+      sender_name         TEXT NOT NULL,
+      body                TEXT,
+      meta                TEXT,
+      received_at         INTEGER NOT NULL,
+      reply_to_id         TEXT
+    );
+    CREATE INDEX IF NOT EXISTS inbox_received_at ON inbox(received_at);
+    CREATE INDEX IF NOT EXISTS inbox_topic       ON inbox(topic);
+    CREATE INDEX IF NOT EXISTS inbox_sender      ON inbox(sender_pubkey);
+  `);
+}
+function insertIfNew(db, row) {
+  const before = db.prepare(`SELECT id FROM inbox WHERE client_message_id = ?`).get(row.client_message_id);
+  if (before)
+    return null;
+  db.prepare(`
+    INSERT INTO inbox (
+      id, client_message_id, broker_message_id, mesh, topic,
+      sender_pubkey, sender_name, body, meta, received_at, reply_to_id
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(client_message_id) DO NOTHING
+  `).run(row.id, row.client_message_id, row.broker_message_id, row.mesh, row.topic, row.sender_pubkey, row.sender_name, row.body, row.meta, row.received_at, row.reply_to_id);
+  const after = db.prepare(`SELECT id FROM inbox WHERE client_message_id = ?`).get(row.client_message_id);
+  return after?.id === row.id ? row.id : null;
+}
+function listInbox(db, p) {
+  const where = [];
+  const args = [];
+  if (p.since !== undefined) {
+    where.push("received_at >= ?");
+    args.push(p.since);
+  }
+  if (p.topic !== undefined) {
+    where.push("topic = ?");
+    args.push(p.topic);
+  }
+  if (p.fromPubkey !== undefined) {
+    where.push("sender_pubkey = ?");
+    args.push(p.fromPubkey);
+  }
+  const sql = `
+    SELECT id, client_message_id, broker_message_id, mesh, topic,
+           sender_pubkey, sender_name, body, meta, received_at, reply_to_id
+      FROM inbox
+     ${where.length ? "WHERE " + where.join(" AND ") : ""}
+     ORDER BY received_at DESC
+     LIMIT ?
+  `;
+  args.push(Math.min(Math.max(p.limit ?? 100, 1), 1000));
+  return db.prepare(sql).all(...args);
+}
+
+// src/daemon/events.ts
+class EventBus {
+  subs = new Set;
+  publish(kind, data) {
+    const e = { kind, ts: new Date().toISOString(), data };
+    for (const s of this.subs) {
+      try {
+        s(e);
+      } catch {}
+    }
+  }
+  subscribe(fn) {
+    this.subs.add(fn);
+    return () => this.subs.delete(fn);
+  }
+}
+function writeSse(res, e, idCounter) {
+  res.write(`id: ${idCounter}
+`);
+  res.write(`event: ${e.kind}
+`);
+  res.write(`data: ${JSON.stringify({ ts: e.ts, ...e.data })}
+
+`);
+}
+function bindSseStream(res, bus) {
+  res.statusCode = 200;
+  res.setHeader("Content-Type", "text/event-stream");
+  res.setHeader("Cache-Control", "no-cache, no-transform");
+  res.setHeader("Connection", "keep-alive");
+  res.setHeader("X-Accel-Buffering", "no");
+  res.write(`: connected
+
+`);
+  let counter = 0;
+  const unsubscribe = bus.subscribe((e) => writeSse(res, e, ++counter));
+  const heartbeat = setInterval(() => {
+    try {
+      res.write(`: keepalive
+
+`);
+    } catch {}
+  }, 15000);
+  const cleanup = () => {
+    clearInterval(heartbeat);
+    unsubscribe();
+    try {
+      res.end();
+    } catch {}
+  };
+  res.on("close", cleanup);
+  res.on("error", cleanup);
+  return cleanup;
+}
+
+// src/daemon/ipc/server.ts
+import { createServer as createServer2 } from "node:http";
+import { chmodSync as chmodSync3, existsSync as existsSync9, unlinkSync as unlinkSync3 } from "node:fs";
+import { timingSafeEqual } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
+function startIpcServer(opts) {
+  const log2 = opts.log ?? defaultLogger;
+  const handler = makeHandler({
+    localToken: opts.localToken,
+    publicHealthCheck: !!opts.publicHealthCheck,
+    log: log2,
+    outboxDb: opts.outboxDb,
+    inboxDb: opts.inboxDb,
+    bus: opts.bus,
+    broker: opts.broker,
+    onPendingInserted: opts.onPendingInserted
+  });
+  if (existsSync9(DAEMON_PATHS.SOCK_FILE)) {
+    try {
+      unlinkSync3(DAEMON_PATHS.SOCK_FILE);
+    } catch {}
+  }
+  const uds = createServer2(handler);
+  const udsReady = new Promise((resolve, reject) => {
+    uds.once("error", reject);
+    uds.listen(DAEMON_PATHS.SOCK_FILE, () => {
+      try {
+        chmodSync3(DAEMON_PATHS.SOCK_FILE, 384);
+      } catch (err) {
+        log2("warn", "uds_chmod_failed", { err: String(err) });
+      }
+      resolve();
+    });
+  });
+  let tcp = null;
+  let tcpReady = Promise.resolve();
+  if (opts.tcpEnabled !== false) {
+    tcp = createServer2(handler);
+    tcpReady = new Promise((resolve, reject) => {
+      tcp.once("error", reject);
+      tcp.listen(opts.tcpPort ?? DAEMON_TCP_DEFAULT_PORT, DAEMON_TCP_HOST, () => resolve());
+    });
+  }
+  return {
+    uds,
+    tcp,
+    ready: Promise.all([udsReady, tcpReady]).then(() => {
+      return;
+    }),
+    close: async () => {
+      await Promise.allSettled([
+        new Promise((res) => uds.close(() => res())),
+        tcp ? new Promise((res) => tcp.close(() => res())) : Promise.resolve()
+      ]);
+      try {
+        unlinkSync3(DAEMON_PATHS.SOCK_FILE);
+      } catch {}
+    }
+  };
+}
+function defaultLogger(level, msg, meta) {
+  const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
+  if (level === "info")
+    process.stdout.write(line + `
+`);
+  else
+    process.stderr.write(line + `
+`);
+}
+function makeHandler(opts) {
+  const tokenBytes = Buffer.from(opts.localToken, "utf8");
+  return async (req, res) => {
+    const url = new URL(req.url ?? "/", "http://daemon.local");
+    if (url.searchParams.has("token")) {
+      opts.log("warn", "ipc_token_in_query_string_rejected", { path: url.pathname });
+      respond(res, 400, { error: "token must be in Authorization header, not query string" });
+      return;
+    }
+    const host = (req.headers.host ?? "").toLowerCase().split(":")[0]?.trim() ?? "";
+    if (host && host !== "localhost" && host !== "127.0.0.1" && host !== "[::1]" && host !== "::1") {
+      respond(res, 403, { error: "forbidden host" });
+      return;
+    }
+    if (req.headers.origin) {
+      respond(res, 403, { error: "forbidden origin" });
+      return;
+    }
+    const isUds = req.socket.remoteAddress === undefined;
+    const isPublicHealth = opts.publicHealthCheck && url.pathname === "/v1/health";
+    if (!isUds && !isPublicHealth) {
+      const authz = req.headers.authorization ?? "";
+      const m = /^Bearer\s+(.+)$/.exec(authz.trim());
+      if (!m || !m[1]) {
+        respond(res, 401, { error: "missing bearer token" });
+        return;
+      }
+      const provided = Buffer.from(m[1], "utf8");
+      if (provided.length !== tokenBytes.length || !timingSafeEqual(provided, tokenBytes)) {
+        opts.log("warn", "ipc_bearer_mismatch", { path: url.pathname });
+        respond(res, 401, { error: "invalid bearer token" });
+        return;
+      }
+    }
+    if (req.method === "GET" && url.pathname === "/v1/version") {
+      respond(res, 200, {
+        daemon_version: VERSION,
+        ipc_api: "v1",
+        ipc_features: ["version", "health", "send", "inbox", "events", "peers", "profile"],
+        schema_version: 1
+      });
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/v1/health") {
+      respond(res, 200, { ok: true, pid: process.pid });
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/v1/events") {
+      if (!opts.bus) {
+        respond(res, 503, { error: "event bus not initialised" });
+        return;
+      }
+      bindSseStream(res, opts.bus);
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/v1/peers") {
+      if (!opts.broker) {
+        respond(res, 503, { error: "broker not initialised" });
+        return;
+      }
+      try {
+        const peers = await opts.broker.listPeers();
+        respond(res, 200, { peers });
+      } catch (e) {
+        respond(res, 502, { error: "broker_unreachable", detail: String(e) });
+      }
+      return;
+    }
+    if (req.method === "POST" && url.pathname === "/v1/profile") {
+      if (!opts.broker) {
+        respond(res, 503, { error: "broker not initialised" });
+        return;
+      }
+      try {
+        const body = await readJsonBody(req, 16 * 1024);
+        if (!body) {
+          respond(res, 400, { error: "expected JSON object" });
+          return;
+        }
+        const updates = {};
+        if (typeof body.summary === "string")
+          opts.broker.setSummary(body.summary);
+        if (body.status === "idle" || body.status === "working" || body.status === "dnd")
+          opts.broker.setStatus(body.status);
+        if (typeof body.visible === "boolean")
+          opts.broker.setVisible(body.visible);
+        const profile = {};
+        if (typeof body.avatar === "string")
+          profile.avatar = body.avatar;
+        if (typeof body.title === "string")
+          profile.title = body.title;
+        if (typeof body.bio === "string")
+          profile.bio = body.bio;
+        if (Array.isArray(body.capabilities))
+          profile.capabilities = body.capabilities.filter((c) => typeof c === "string");
+        if (Object.keys(profile).length > 0)
+          opts.broker.setProfile(profile);
+        Object.assign(updates, body);
+        respond(res, 200, { ok: true, applied: Object.keys(updates) });
+      } catch (e) {
+        respond(res, 400, { error: String(e) });
+      }
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/v1/inbox") {
+      if (!opts.inboxDb) {
+        respond(res, 503, { error: "inbox not initialised" });
+        return;
+      }
+      const sinceRaw = url.searchParams.get("since");
+      const since = sinceRaw ? Date.parse(sinceRaw) : undefined;
+      const topic = url.searchParams.get("topic") ?? undefined;
+      const fromPubkey = url.searchParams.get("from") ?? undefined;
+      const limitRaw = url.searchParams.get("limit");
+      const limit = limitRaw ? Number.parseInt(limitRaw, 10) : undefined;
+      const rows = listInbox(opts.inboxDb, {
+        since: Number.isFinite(since) ? since : undefined,
+        topic,
+        fromPubkey,
+        limit: Number.isFinite(limit ?? NaN) ? limit : undefined
+      });
+      respond(res, 200, {
+        items: rows.map((r) => ({
+          id: r.id,
+          client_message_id: r.client_message_id,
+          broker_message_id: r.broker_message_id,
+          mesh: r.mesh,
+          topic: r.topic,
+          sender_pubkey: r.sender_pubkey,
+          sender_name: r.sender_name,
+          body: r.body,
+          received_at: new Date(r.received_at).toISOString(),
+          reply_to_id: r.reply_to_id
+        }))
+      });
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/v1/outbox") {
+      if (!opts.outboxDb) {
+        respond(res, 503, { error: "outbox not initialised" });
+        return;
+      }
+      const statusParam = url.searchParams.get("status") ?? undefined;
+      const allowed = ["pending", "inflight", "done", "dead", "aborted"];
+      const status = statusParam && allowed.includes(statusParam) ? statusParam : undefined;
+      const limitRaw = url.searchParams.get("limit");
+      const limit = limitRaw ? Number.parseInt(limitRaw, 10) : undefined;
+      const rows = listOutbox(opts.outboxDb, {
+        status,
+        limit: Number.isFinite(limit ?? NaN) ? limit : undefined
+      });
+      respond(res, 200, {
+        items: rows.map((r) => ({
+          id: r.id,
+          client_message_id: r.client_message_id,
+          status: r.status,
+          attempts: r.attempts,
+          enqueued_at: new Date(r.enqueued_at).toISOString(),
+          next_attempt_at: new Date(r.next_attempt_at).toISOString(),
+          delivered_at: r.delivered_at ? new Date(r.delivered_at).toISOString() : null,
+          broker_message_id: r.broker_message_id,
+          last_error: r.last_error,
+          aborted_at: r.aborted_at ? new Date(r.aborted_at).toISOString() : null,
+          aborted_by: r.aborted_by,
+          superseded_by: r.superseded_by,
+          payload_bytes: r.payload?.byteLength ?? 0
+        }))
+      });
+      return;
+    }
+    if (req.method === "POST" && url.pathname === "/v1/outbox/requeue") {
+      if (!opts.outboxDb) {
+        respond(res, 503, { error: "outbox not initialised" });
+        return;
+      }
+      try {
+        const body = await readJsonBody(req, 4 * 1024);
+        if (!body || typeof body.id !== "string") {
+          respond(res, 400, { error: "missing 'id'" });
+          return;
+        }
+        const newId = typeof body.new_client_message_id === "string" && body.new_client_message_id.trim() ? body.new_client_message_id.trim() : randomUUID4();
+        const result = requeueDeadOrPending(opts.outboxDb, {
+          id: body.id,
+          newClientMessageId: newId,
+          newRowId: randomUUID4(),
+          now: Date.now(),
+          abortedBy: typeof body.aborted_by === "string" ? body.aborted_by : "operator"
+        });
+        if (!result) {
+          respond(res, 409, { error: "row not found, already aborted, or already done" });
+          return;
+        }
+        respond(res, 200, {
+          aborted_row_id: result.abortedRowId,
+          new_row_id: result.newRowId,
+          new_client_message_id: result.newClientMessageId
+        });
+        opts.onPendingInserted?.();
+      } catch (e) {
+        respond(res, 400, { error: String(e) });
+      }
+      return;
+    }
+    if (req.method === "POST" && url.pathname === "/v1/send") {
+      if (!opts.outboxDb) {
+        respond(res, 503, { error: "outbox not initialised" });
+        return;
+      }
+      try {
+        const body = await readJsonBody(req, 256 * 1024);
+        const parsed = parseSendRequest(body, req.headers["idempotency-key"]);
+        if ("error" in parsed) {
+          respond(res, 400, { error: parsed.error });
+          return;
+        }
+        const outcome = acceptSend(parsed.req, { db: opts.outboxDb });
+        switch (outcome.kind) {
+          case "accepted_pending":
+            respond(res, outcome.status, {
+              client_message_id: outcome.client_message_id,
+              status: "queued"
+            });
+            opts.onPendingInserted?.();
+            return;
+          case "accepted_inflight":
+            respond(res, outcome.status, {
+              client_message_id: outcome.client_message_id,
+              status: "inflight"
+            });
+            return;
+          case "accepted_done":
+            respond(res, outcome.status, {
+              client_message_id: outcome.client_message_id,
+              broker_message_id: outcome.broker_message_id,
+              duplicate: true
+            });
+            return;
+          case "conflict":
+            respond(res, outcome.status, {
+              error: "idempotency_key_reused",
+              conflict: outcome.reason,
+              daemon_fingerprint_prefix: outcome.daemon_fingerprint_prefix,
+              broker_message_id: outcome.broker_message_id ?? null
+            });
+            return;
+        }
+      } catch (err) {
+        opts.log("error", "ipc_send_failed", { err: String(err) });
+        respond(res, 500, { error: "internal" });
+        return;
+      }
+    }
+    respond(res, 404, { error: "not found" });
+  };
+}
+async function readJsonBody(req, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of req) {
+    const buf = chunk;
+    total += buf.length;
+    if (total > maxBytes)
+      throw new Error("payload_too_large");
+    chunks.push(buf);
+  }
+  if (total === 0)
+    return null;
+  const text = Buffer.concat(chunks).toString("utf8");
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error("invalid_json");
+  }
+}
+function parseSendRequest(body, idempotencyHeader) {
+  if (!body || typeof body !== "object")
+    return { error: "expected JSON object" };
+  const b = body;
+  const to = typeof b.to === "string" ? b.to.trim() : "";
+  const message = typeof b.message === "string" ? b.message : "";
+  if (!to)
+    return { error: "missing 'to'" };
+  if (!message)
+    return { error: "missing 'message'" };
+  const priority = b.priority;
+  if (priority !== undefined && priority !== "now" && priority !== "next" && priority !== "low") {
+    return { error: "priority must be 'now' | 'next' | 'low'" };
+  }
+  const meta = b.meta;
+  if (meta !== undefined && meta !== null && (typeof meta !== "object" || Array.isArray(meta))) {
+    return { error: "'meta' must be an object" };
+  }
+  let destination_kind;
+  let destination_ref;
+  if (to.startsWith("@")) {
+    destination_kind = "topic";
+    destination_ref = to.slice(1);
+  } else if (to === "*") {
+    destination_kind = "topic";
+    destination_ref = "*";
+  } else {
+    destination_kind = "dm";
+    destination_ref = to;
+  }
+  const headerId = Array.isArray(idempotencyHeader) ? idempotencyHeader[0] : idempotencyHeader;
+  const client_message_id = typeof b.client_message_id === "string" && b.client_message_id.trim() ? b.client_message_id.trim() : typeof headerId === "string" && headerId.trim() ? headerId.trim() : undefined;
+  const reply_to_id = typeof b.reply_to_id === "string" ? b.reply_to_id : undefined;
+  return {
+    req: {
+      to,
+      message,
+      priority,
+      meta: meta ?? undefined,
+      reply_to_id,
+      client_message_id,
+      destination_kind,
+      destination_ref
+    }
+  };
+}
+function respond(res, status, body) {
+  const json = JSON.stringify(body);
+  res.statusCode = status;
+  res.setHeader("Content-Type", "application/json");
+  res.setHeader("Content-Length", Buffer.byteLength(json));
+  res.end(json);
+}
+var init_server = __esm(() => {
+  init_paths2();
+  init_send2();
+  init_urls();
+});
+
+// src/daemon/broker.ts
+import WebSocket2 from "ws";
+
+class DaemonBrokerClient {
+  mesh;
+  opts;
+  ws = null;
+  _status = "closed";
+  closed = false;
+  reconnectAttempt = 0;
+  reconnectTimer = null;
+  helloTimer = null;
+  pendingAcks = new Map;
+  peerListResolvers = new Map;
+  sessionPubkey = null;
+  sessionSecretKey = null;
+  opens = [];
+  reqCounter = 0;
+  constructor(mesh, opts = {}) {
+    this.mesh = mesh;
+    this.opts = opts;
+  }
+  get status() {
+    return this._status;
+  }
+  get meshSlug() {
+    return this.mesh.slug;
+  }
+  get meshId() {
+    return this.mesh.meshId;
+  }
+  log = (level, msg, meta) => {
+    (this.opts.log ?? defaultLog)(level, msg, { mesh: this.mesh.slug, ...meta });
+  };
+  setConnStatus(s) {
+    if (this._status === s)
+      return;
+    this._status = s;
+    this.opts.onStatusChange?.(s);
+  }
+  async connect() {
+    if (this.closed)
+      throw new Error("client_closed");
+    if (this._status === "connecting" || this._status === "open")
+      return;
+    this.setConnStatus("connecting");
+    const ws = new WebSocket2(this.mesh.brokerUrl);
+    this.ws = ws;
+    return new Promise((resolve, reject) => {
+      ws.on("open", async () => {
+        try {
+          if (!this.sessionPubkey) {
+            const { generateKeypair: generateKeypair4 } = await Promise.resolve().then(() => (init_facade7(), exports_facade4));
+            const kp = await generateKeypair4();
+            this.sessionPubkey = kp.publicKey;
+            this.sessionSecretKey = kp.secretKey;
+          }
+          const { timestamp: timestamp2, signature } = await signHello(this.mesh.meshId, this.mesh.memberId, this.mesh.pubkey, this.mesh.secretKey);
+          ws.send(JSON.stringify({
+            type: "hello",
+            meshId: this.mesh.meshId,
+            memberId: this.mesh.memberId,
+            pubkey: this.mesh.pubkey,
+            sessionPubkey: this.sessionPubkey,
+            displayName: this.opts.displayName,
+            sessionId: `daemon-${process.pid}`,
+            pid: process.pid,
+            cwd: process.cwd(),
+            hostname: __require("node:os").hostname(),
+            peerType: "ai",
+            channel: "claudemesh-daemon",
+            timestamp: timestamp2,
+            signature
+          }));
+          this.helloTimer = setTimeout(() => {
+            this.log("warn", "broker_hello_ack_timeout");
+            try {
+              ws.close();
+            } catch {}
+            reject(new Error("hello_ack_timeout"));
+          }, HELLO_ACK_TIMEOUT_MS2);
+        } catch (e) {
+          reject(e instanceof Error ? e : new Error(String(e)));
+        }
+      });
+      ws.on("message", (raw) => {
+        let msg;
+        try {
+          msg = JSON.parse(raw.toString());
+        } catch {
+          return;
+        }
+        if (msg.type === "hello_ack") {
+          if (this.helloTimer)
+            clearTimeout(this.helloTimer);
+          this.helloTimer = null;
+          this.setConnStatus("open");
+          this.reconnectAttempt = 0;
+          const queued = this.opens.slice();
+          this.opens.length = 0;
+          for (const fn of queued) {
+            try {
+              fn();
+            } catch (e) {
+              this.log("warn", "open_handler_failed", { err: String(e) });
+            }
+          }
+          resolve();
+          return;
+        }
+        if (msg.type === "ack") {
+          const id = String(msg.id ?? "");
+          const ack = this.pendingAcks.get(id);
+          if (ack) {
+            this.pendingAcks.delete(id);
+            clearTimeout(ack.timer);
+            if (typeof msg.error === "string" && msg.error.length > 0) {
+              ack.resolve({ ok: false, error: msg.error, permanent: classifyPermanent(msg.error) });
+            } else {
+              ack.resolve({ ok: true, messageId: String(msg.messageId ?? id) });
+            }
+          }
+          return;
+        }
+        if (msg.type === "peers_list") {
+          const reqId = String(msg._reqId ?? "");
+          const pending = this.peerListResolvers.get(reqId);
+          if (pending) {
+            this.peerListResolvers.delete(reqId);
+            clearTimeout(pending.timer);
+            pending.resolve(Array.isArray(msg.peers) ? msg.peers : []);
+          }
+          return;
+        }
+        if (msg.type === "push" || msg.type === "inbound") {
+          this.opts.onPush?.(msg);
+          return;
+        }
+      });
+      ws.on("close", (code, reason) => {
+        if (this.helloTimer) {
+          clearTimeout(this.helloTimer);
+          this.helloTimer = null;
+        }
+        this.failPendingAcks(`broker_disconnected_${code}`);
+        if (this.closed) {
+          this.setConnStatus("closed");
+          return;
+        }
+        this.setConnStatus("reconnecting");
+        const wait = BACKOFF_CAPS_MS[Math.min(this.reconnectAttempt, BACKOFF_CAPS_MS.length - 1)] ?? 30000;
+        this.reconnectAttempt++;
+        this.log("info", "broker_reconnect_scheduled", { wait_ms: wait, code, reason: reason.toString("utf8") });
+        this.reconnectTimer = setTimeout(() => this.connect().catch((err) => this.log("warn", "broker_reconnect_failed", { err: String(err) })), wait);
+        if (this._status === "connecting")
+          reject(new Error(`closed_before_hello_${code}`));
+      });
+      ws.on("error", (err) => this.log("warn", "broker_ws_error", { err: err.message }));
+    });
+  }
+  send(req) {
+    return new Promise((resolve) => {
+      const dispatch = () => {
+        if (!this.ws || this.ws.readyState !== this.ws.OPEN) {
+          resolve({ ok: false, error: "broker_not_open", permanent: false });
+          return;
+        }
+        const id = req.client_message_id;
+        const timer = setTimeout(() => {
+          if (this.pendingAcks.delete(id)) {
+            resolve({ ok: false, error: "ack_timeout", permanent: false });
+          }
+        }, SEND_ACK_TIMEOUT_MS);
+        this.pendingAcks.set(id, { resolve, timer });
+        try {
+          this.ws.send(JSON.stringify({
+            type: "send",
+            id,
+            client_message_id: id,
+            request_fingerprint: req.request_fingerprint_hex,
+            targetSpec: req.targetSpec,
+            priority: req.priority,
+            nonce: req.nonce,
+            ciphertext: req.ciphertext
+          }));
+        } catch (e) {
+          this.pendingAcks.delete(id);
+          clearTimeout(timer);
+          resolve({ ok: false, error: `ws_write_failed: ${String(e)}`, permanent: false });
+        }
+      };
+      if (this._status === "open")
+        dispatch();
+      else
+        this.opens.push(dispatch);
+    });
+  }
+  async listPeers(timeoutMs = 5000) {
+    if (this._status !== "open" || !this.ws)
+      return [];
+    return new Promise((resolve) => {
+      const reqId = `pl-${++this.reqCounter}`;
+      const timer = setTimeout(() => {
+        if (this.peerListResolvers.delete(reqId))
+          resolve([]);
+      }, timeoutMs);
+      this.peerListResolvers.set(reqId, { resolve, timer });
+      try {
+        this.ws.send(JSON.stringify({ type: "list_peers", _reqId: reqId }));
+      } catch {
+        this.peerListResolvers.delete(reqId);
+        clearTimeout(timer);
+        resolve([]);
+      }
+    });
+  }
+  setProfile(profile) {
+    if (this._status !== "open" || !this.ws)
+      return;
+    try {
+      this.ws.send(JSON.stringify({ type: "set_profile", ...profile }));
+    } catch {}
+  }
+  setSummary(summary) {
+    if (this._status !== "open" || !this.ws)
+      return;
+    try {
+      this.ws.send(JSON.stringify({ type: "set_summary", summary }));
+    } catch {}
+  }
+  setStatus(status) {
+    if (this._status !== "open" || !this.ws)
+      return;
+    try {
+      this.ws.send(JSON.stringify({ type: "set_status", status }));
+    } catch {}
+  }
+  setVisible(visible) {
+    if (this._status !== "open" || !this.ws)
+      return;
+    try {
+      this.ws.send(JSON.stringify({ type: "set_visible", visible }));
+    } catch {}
+  }
+  async close() {
+    this.closed = true;
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    if (this.helloTimer) {
+      clearTimeout(this.helloTimer);
+      this.helloTimer = null;
+    }
+    this.failPendingAcks("daemon_shutdown");
+    try {
+      this.ws?.close();
+    } catch {}
+    this.setConnStatus("closed");
+  }
+  getSessionKeys() {
+    if (!this.sessionPubkey || !this.sessionSecretKey)
+      return null;
+    return { sessionPubkey: this.sessionPubkey, sessionSecretKey: this.sessionSecretKey };
+  }
+  failPendingAcks(reason) {
+    for (const [id, ack] of this.pendingAcks) {
+      clearTimeout(ack.timer);
+      ack.resolve({ ok: false, error: reason, permanent: false });
+      this.pendingAcks.delete(id);
+    }
+  }
+}
+function defaultLog(level, msg, meta) {
+  const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
+  if (level === "info")
+    process.stdout.write(line + `
+`);
+  else
+    process.stderr.write(line + `
+`);
+}
+function classifyPermanent(err) {
+  return /payload_too_large|forbidden|not_found|invalid|schema|auth|signature/i.test(err);
+}
+var HELLO_ACK_TIMEOUT_MS2 = 5000, SEND_ACK_TIMEOUT_MS = 15000, BACKOFF_CAPS_MS;
+var init_broker = __esm(() => {
+  init_hello_sig();
+  BACKOFF_CAPS_MS = [1000, 2000, 4000, 8000, 16000, 30000];
+});
+
+// src/daemon/drain.ts
+function startDrainWorker(opts) {
+  const log2 = opts.log ?? defaultLog2;
+  let stopped = false;
+  let wakeResolve = null;
+  let wakePromise = new Promise((r) => {
+    wakeResolve = r;
+  });
+  const wake = () => {
+    if (wakeResolve) {
+      const r = wakeResolve;
+      wakeResolve = null;
+      r();
+    }
+  };
+  const tick = async () => {
+    while (!stopped) {
+      try {
+        await drainOnce(opts, log2);
+      } catch (e) {
+        log2("warn", "drain_tick_failed", { err: String(e) });
+      }
+      await Promise.race([
+        wakePromise,
+        new Promise((r) => setTimeout(r, POLL_INTERVAL_MS))
+      ]);
+      wakePromise = new Promise((r) => {
+        wakeResolve = r;
+      });
+    }
+  };
+  tick();
+  return {
+    wake,
+    close: async () => {
+      stopped = true;
+      wake();
+    }
+  };
+}
+async function drainOnce(opts, log2) {
+  const now = Date.now();
+  const rows = opts.db.prepare(`
+    SELECT id, client_message_id, request_fingerprint, payload, attempts
+      FROM outbox
+     WHERE status = 'pending' AND next_attempt_at <= ?
+     ORDER BY enqueued_at
+     LIMIT 32
+  `).all(now);
+  if (rows.length === 0)
+    return;
+  for (const row of rows) {
+    if (markInflight(opts.db, row.id, now) === 0)
+      continue;
+    const fpHex = bufferToHex(row.request_fingerprint);
+    const sessionKeys = opts.broker.getSessionKeys();
+    const targetSpec = "*";
+    const nonce = await randomNonce2();
+    const ciphertext = Buffer.from(row.payload).toString("base64");
+    let res;
+    try {
+      res = await opts.broker.send({
+        targetSpec,
+        priority: "next",
+        nonce,
+        ciphertext,
+        client_message_id: row.client_message_id,
+        request_fingerprint_hex: fpHex
+      });
+    } catch (e) {
+      log2("warn", "drain_send_threw", { id: row.id, err: String(e) });
+      backoffPending(opts.db, row.id, row.attempts + 1, "exception", String(e));
+      continue;
+    }
+    if (res.ok) {
+      markDone(opts.db, row.id, res.messageId, Date.now());
+    } else if (res.permanent) {
+      log2("warn", "drain_permanent_failure", { id: row.id, err: res.error });
+      markDead(opts.db, row.id, res.error);
+    } else if (row.attempts + 1 >= MAX_ATTEMPTS_PER_ROW) {
+      log2("warn", "drain_max_attempts", { id: row.id, err: res.error });
+      markDead(opts.db, row.id, `max_attempts: ${res.error}`);
+    } else {
+      backoffPending(opts.db, row.id, row.attempts + 1, "retry", res.error);
+    }
+  }
+}
+function markInflight(db, id, now) {
+  return Number(db.prepare(`
+    UPDATE outbox
+       SET status = 'inflight', attempts = attempts + 1, next_attempt_at = ?
+     WHERE id = ? AND status = 'pending'
+  `).run(now + BACKOFF_CAP_MS, id).changes);
+}
+function markDone(db, id, brokerMessageId, now) {
+  db.prepare(`
+    UPDATE outbox
+       SET status = 'done', delivered_at = ?, broker_message_id = ?, last_error = NULL
+     WHERE id = ?
+  `).run(now, brokerMessageId, id);
+}
+function markDead(db, id, err) {
+  db.prepare(`UPDATE outbox SET status = 'dead', last_error = ? WHERE id = ?`).run(err, id);
+}
+function backoffPending(db, id, attempts, _kind, err) {
+  const wait = Math.min(BACKOFF_CAP_MS, BACKOFF_BASE_MS * 2 ** Math.min(attempts, 12));
+  const next = Date.now() + wait;
+  db.prepare(`
+    UPDATE outbox
+       SET status = 'pending', attempts = ?, next_attempt_at = ?, last_error = ?
+     WHERE id = ?
+  `).run(attempts, next, err, id);
+}
+function bufferToHex(b) {
+  let s = "";
+  for (let i = 0;i < b.length; i++)
+    s += b[i].toString(16).padStart(2, "0");
+  return s;
+}
+async function randomNonce2() {
+  const { randomBytes: randomBytes5 } = await import("node:crypto");
+  return randomBytes5(24).toString("base64");
+}
+function defaultLog2(level, msg, meta) {
+  const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
+  if (level === "info")
+    process.stdout.write(line + `
+`);
+  else
+    process.stderr.write(line + `
+`);
+}
+var POLL_INTERVAL_MS = 500, MAX_ATTEMPTS_PER_ROW = 25, BACKOFF_BASE_MS = 500, BACKOFF_CAP_MS = 30000;
+var init_drain = () => {};
+
+// src/daemon/inbound.ts
+import { randomUUID as randomUUID5 } from "node:crypto";
+async function handleBrokerPush(msg, ctx) {
+  if (msg.subtype === "system" && typeof msg.event === "string") {
+    ctx.bus.publish(mapSystemEventKind(msg.event), {
+      mesh: ctx.meshSlug,
+      event: msg.event,
+      ...msg.eventData ?? {}
+    });
+    return;
+  }
+  if (msg.type !== "push")
+    return;
+  const brokerMessageId = stringOrNull(msg.messageId);
+  const senderPubkey = stringOrNull(msg.senderPubkey) ?? "";
+  const senderName = stringOrNull(msg.senderName) ?? senderPubkey.slice(0, 8);
+  const topic = stringOrNull(msg.topic);
+  const replyToId = stringOrNull(msg.replyToId);
+  const ciphertext = stringOrNull(msg.ciphertext) ?? "";
+  const nonce = stringOrNull(msg.nonce) ?? "";
+  const createdAt = stringOrNull(msg.createdAt);
+  const clientMessageId = stringOrNull(msg.client_message_id) ?? brokerMessageId ?? randomUUID5();
+  const body = await decryptOrFallback({
+    ciphertext,
+    nonce,
+    senderPubkey,
+    ctx
+  });
+  const id = randomUUID5();
+  const inserted = insertIfNew(ctx.db, {
+    id,
+    client_message_id: clientMessageId,
+    broker_message_id: brokerMessageId,
+    mesh: ctx.meshSlug,
+    topic,
+    sender_pubkey: senderPubkey,
+    sender_name: senderName,
+    body,
+    meta: createdAt ? JSON.stringify({ created_at: createdAt }) : null,
+    received_at: Date.now(),
+    reply_to_id: replyToId
+  });
+  if (!inserted)
+    return;
+  ctx.bus.publish("message", {
+    id,
+    mesh: ctx.meshSlug,
+    client_message_id: clientMessageId,
+    broker_message_id: brokerMessageId,
+    sender_pubkey: senderPubkey,
+    sender_name: senderName,
+    topic,
+    reply_to_id: replyToId,
+    body,
+    created_at: createdAt
+  });
+}
+async function decryptOrFallback(args) {
+  const { ciphertext, nonce, senderPubkey, ctx } = args;
+  if (!ciphertext)
+    return null;
+  if (nonce && senderPubkey) {
+    const envelope = { nonce, ciphertext };
+    if (ctx.sessionSecretKeyHex) {
+      const pt = await decryptDirect(envelope, senderPubkey, ctx.sessionSecretKeyHex);
+      if (pt !== null)
+        return pt;
+    }
+    if (ctx.recipientSecretKeyHex) {
+      const pt = await decryptDirect(envelope, senderPubkey, ctx.recipientSecretKeyHex);
+      if (pt !== null)
+        return pt;
+    }
+  }
+  try {
+    return Buffer.from(ciphertext, "base64").toString("utf8");
+  } catch (e) {
+    ctx.log?.("warn", "inbound_b64_decode_failed", { err: String(e) });
+    return null;
+  }
+}
+function stringOrNull(v) {
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+function mapSystemEventKind(event) {
+  if (event === "peer_joined")
+    return "peer_join";
+  if (event === "peer_left")
+    return "peer_leave";
+  return "system";
+}
+var init_inbound = __esm(() => {
+  init_facade7();
+});
+
+// src/daemon/identity.ts
+var exports_identity = {};
+__export(exports_identity, {
+  computeCurrentFingerprint: () => computeCurrentFingerprint,
+  checkFingerprint: () => checkFingerprint,
+  acceptCurrentHost: () => acceptCurrentHost
+});
+import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join7 } from "node:path";
+import { createHash as createHash2 } from "node:crypto";
+import { networkInterfaces } from "node:os";
+function path() {
+  return join7(DAEMON_PATHS.DAEMON_DIR, FILE_NAME);
+}
+function computeCurrentFingerprint() {
+  const host_id = readHostId() ?? "";
+  const stable_mac = pickStableMac() ?? "";
+  const fp = createHash2("sha256").update(host_id, "utf8").update("\x00").update(stable_mac, "utf8").digest("hex");
+  return {
+    schema_version: 1,
+    fingerprint: fp,
+    host_id,
+    stable_mac,
+    written_at: new Date().toISOString()
+  };
+}
+function checkFingerprint() {
+  const current = computeCurrentFingerprint();
+  if (!existsSync10(path())) {
+    writeFileSync8(path(), JSON.stringify(current, null, 2), { mode: 384 });
+    return { result: "first_run", current };
+  }
+  let stored;
+  try {
+    stored = JSON.parse(readFileSync7(path(), "utf8"));
+  } catch {
+    return { result: "unavailable", current };
+  }
+  if (stored.fingerprint === current.fingerprint)
+    return { result: "match", current, stored };
+  return { result: "mismatch", current, stored };
+}
+function acceptCurrentHost() {
+  const current = computeCurrentFingerprint();
+  writeFileSync8(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  return current;
+}
+function readHostId() {
+  if (process.platform === "linux") {
+    for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+      try {
+        const raw = readFileSync7(p, "utf8").trim();
+        if (raw)
+          return `linux:${raw}`;
+      } catch {}
+    }
+    return null;
+  }
+  if (process.platform === "darwin") {
+    return null;
+  }
+  return null;
+}
+function pickStableMac() {
+  const ifs = networkInterfaces();
+  const candidates = [];
+  for (const [name, addrs] of Object.entries(ifs)) {
+    if (!addrs)
+      continue;
+    if (isIgnoredInterface(name))
+      continue;
+    for (const a of addrs) {
+      if (a.internal)
+        continue;
+      if (!a.mac || a.mac === "00:00:00:00:00:00")
+        continue;
+      candidates.push(`${name}::${a.mac}`);
+      break;
+    }
+  }
+  if (candidates.length === 0)
+    return null;
+  candidates.sort();
+  const first = candidates[0];
+  const idx = first.indexOf("::");
+  return idx >= 0 ? first.slice(idx + 2) : first;
+}
+function isIgnoredInterface(name) {
+  return /^(lo|docker|br-|veth|tap|tun|tailscale|wg|utun|ppp|vboxnet|vmnet|awdl|llw)/i.test(name);
+}
+var FILE_NAME = "host_fingerprint.json";
+var init_identity = __esm(() => {
+  init_paths2();
+});
+
+// src/daemon/run.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync8 } from "node:fs";
+function detectContainer() {
+  if (process.env.KUBERNETES_SERVICE_HOST)
+    return true;
+  if (process.env.CONTAINER === "1")
+    return true;
+  try {
+    if (existsSync11("/.dockerenv"))
+      return true;
+    const cg = readFileSync8("/proc/1/cgroup", "utf8");
+    if (/(docker|kubepods|containerd)/.test(cg))
+      return true;
+  } catch {}
+  return false;
+}
+async function runDaemon(opts = {}) {
+  mkdirSync6(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
+  const lock = acquireSingletonLock();
+  if (lock.result === "already-running") {
+    process.stderr.write(`daemon already running (pid ${lock.pid})
+`);
+    return 1;
+  }
+  if (lock.result === "stale") {
+    process.stderr.write(`recovered stale pid file; starting fresh
+`);
+  }
+  const fpCheck = checkFingerprint();
+  const policy = opts.clonePolicy ?? "refuse";
+  if (fpCheck.result === "mismatch") {
+    const msg = `host_fingerprint mismatch: this daemon dir was started on a different host.`;
+    if (policy === "refuse") {
+      process.stderr.write(`${msg}
+`);
+      process.stderr.write(`  stored host_id: ${fpCheck.stored?.host_id}
+`);
+      process.stderr.write(`  current host_id: ${fpCheck.current.host_id}
+`);
+      process.stderr.write(`Run \`claudemesh daemon accept-host\` to write a fresh fingerprint, or
+`);
+      process.stderr.write(`run \`claudemesh daemon remint\` to mint a new keypair (Sprint 7+).
+`);
+      releaseSingletonLock();
+      return 4;
+    }
+    if (policy === "warn") {
+      process.stderr.write(`WARN: ${msg} (continuing per [clone] policy=warn)
+`);
+    }
+  }
+  if (fpCheck.result === "first_run") {
+    process.stdout.write(JSON.stringify({
+      msg: "host_fingerprint_written",
+      fingerprint_prefix: fpCheck.current.fingerprint.slice(0, 16),
+      ts: new Date().toISOString()
+    }) + `
+`);
+  }
+  const localToken = ensureLocalToken();
+  const tcpEnabled = opts.tcpEnabled ?? !detectContainer();
+  let outboxDb;
+  let inboxDb;
+  try {
+    outboxDb = await openSqlite(DAEMON_PATHS.OUTBOX_DB);
+    migrateOutbox(outboxDb);
+    inboxDb = await openSqlite(DAEMON_PATHS.INBOX_DB);
+    migrateInbox(inboxDb);
+  } catch (err) {
+    process.stderr.write(`db open failed: ${String(err)}
+`);
+    releaseSingletonLock();
+    return 1;
+  }
+  const bus = new EventBus;
+  const cfg = readConfig();
+  let mesh = null;
+  if (opts.mesh) {
+    mesh = cfg.meshes.find((m) => m.slug === opts.mesh) ?? null;
+    if (!mesh) {
+      process.stderr.write(`mesh not found: ${opts.mesh}
+`);
+      process.stderr.write(`joined meshes: ${cfg.meshes.map((m) => m.slug).join(", ") || "(none)"}
+`);
+      releaseSingletonLock();
+      try {
+        outboxDb.close();
+      } catch {}
+      return 2;
+    }
+  } else if (cfg.meshes.length === 1) {
+    mesh = cfg.meshes[0];
+  } else if (cfg.meshes.length === 0) {
+    process.stderr.write(`no mesh joined; run \`claudemesh join <invite-url>\` first
+`);
+    releaseSingletonLock();
+    try {
+      outboxDb.close();
+    } catch {}
+    return 2;
+  } else {
+    process.stderr.write(`multiple meshes joined; pass --mesh <slug>
+`);
+    process.stderr.write(`available: ${cfg.meshes.map((m) => m.slug).join(", ")}
+`);
+    releaseSingletonLock();
+    try {
+      outboxDb.close();
+    } catch {}
+    return 2;
+  }
+  const broker = new DaemonBrokerClient(mesh, {
+    displayName: opts.displayName,
+    onStatusChange: (s) => {
+      process.stdout.write(JSON.stringify({
+        msg: "broker_status",
+        status: s,
+        mesh: mesh.slug,
+        ts: new Date().toISOString()
+      }) + `
+`);
+      bus.publish("broker_status", { mesh: mesh.slug, status: s });
+    },
+    onPush: (m) => {
+      const sessionKeys = broker.getSessionKeys();
+      handleBrokerPush(m, {
+        db: inboxDb,
+        bus,
+        meshSlug: mesh.slug,
+        recipientSecretKeyHex: mesh.secretKey,
+        sessionSecretKeyHex: sessionKeys?.sessionSecretKey
+      });
+    }
+  });
+  broker.connect().catch((err) => process.stderr.write(`broker connect failed: ${String(err)}
+`));
+  let drain = null;
+  drain = startDrainWorker({ db: outboxDb, broker });
+  const ipc2 = startIpcServer({
+    localToken,
+    tcpEnabled,
+    publicHealthCheck: opts.publicHealthCheck,
+    outboxDb,
+    inboxDb,
+    bus,
+    broker,
+    onPendingInserted: () => drain?.wake()
+  });
+  try {
+    await ipc2.ready;
+  } catch (err) {
+    process.stderr.write(`ipc listen failed: ${String(err)}
+`);
+    releaseSingletonLock();
+    return 1;
+  }
+  process.stdout.write(JSON.stringify({
+    msg: "daemon_started",
+    pid: process.pid,
+    sock: DAEMON_PATHS.SOCK_FILE,
+    tcp: tcpEnabled ? `127.0.0.1:47823` : null,
+    mesh: mesh.slug,
+    ts: new Date().toISOString()
+  }) + `
+`);
+  let shuttingDown = false;
+  const shutdown = async (sig) => {
+    if (shuttingDown)
+      return;
+    shuttingDown = true;
+    process.stdout.write(JSON.stringify({ msg: "daemon_shutdown", signal: sig, ts: new Date().toISOString() }) + `
+`);
+    if (drain)
+      await drain.close();
+    await broker.close();
+    await ipc2.close();
+    try {
+      outboxDb.close();
+    } catch {}
+    try {
+      inboxDb.close();
+    } catch {}
+    releaseSingletonLock();
+    process.exit(0);
+  };
+  process.on("SIGINT", () => shutdown("SIGINT"));
+  process.on("SIGTERM", () => shutdown("SIGTERM"));
+  return new Promise(() => {});
+}
+var init_run = __esm(() => {
+  init_paths2();
+  init_lock();
+  init_local_token();
+  init_server();
+  init_broker();
+  init_drain();
+  init_inbound();
+  init_identity();
+  init_facade();
+});
+
+// src/daemon/service-install.ts
+var exports_service_install = {};
+__export(exports_service_install, {
+  uninstallService: () => uninstallService,
+  readInstalledUnit: () => readInstalledUnit,
+  installService: () => installService,
+  detectPlatform: () => detectPlatform
+});
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, writeFileSync as writeFileSync9, unlinkSync as unlinkSync4, readFileSync as readFileSync9 } from "node:fs";
+import { execSync as execSync2 } from "node:child_process";
+import { homedir as homedir6 } from "node:os";
+import { join as join8, dirname as dirname5 } from "node:path";
+function detectPlatform() {
+  if (process.platform === "darwin")
+    return "darwin";
+  if (process.platform === "linux")
+    return "linux";
+  return null;
+}
+function isCi() {
+  return !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI || process.env.BUILDKITE || process.env.CIRCLECI || process.env.JENKINS_URL);
+}
+function installService(args) {
+  const platform5 = detectPlatform();
+  if (!platform5)
+    throw new Error(`unsupported platform: ${process.platform}`);
+  if (isCi() && !args.allowCi) {
+    throw new Error("Refusing to install persistent service in CI; pass --allow-ci-persistent to override.");
+  }
+  if (!existsSync12(args.binaryPath)) {
+    throw new Error(`binary not found at ${args.binaryPath}`);
+  }
+  mkdirSync7(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
+  if (platform5 === "darwin")
+    return installDarwin(args);
+  return installLinux(args);
+}
+function uninstallService() {
+  const platform5 = detectPlatform();
+  const removed = [];
+  if (platform5 === "darwin") {
+    const p = darwinPlistPath();
+    try {
+      execSync2(`launchctl bootout gui/$(id -u)/${SERVICE_LABEL}`, { stdio: "ignore" });
+    } catch {}
+    if (existsSync12(p)) {
+      unlinkSync4(p);
+      removed.push(p);
+    }
+  } else if (platform5 === "linux") {
+    const p = linuxUnitPath();
+    try {
+      execSync2(`systemctl --user disable --now ${SYSTEMD_UNIT}`, { stdio: "ignore" });
+    } catch {}
+    if (existsSync12(p)) {
+      unlinkSync4(p);
+      removed.push(p);
+    }
+  }
+  return { platform: platform5, removed };
+}
+function darwinPlistPath() {
+  return join8(homedir6(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+}
+function installDarwin(args) {
+  const plist = darwinPlistPath();
+  mkdirSync7(dirname5(plist), { recursive: true });
+  const log2 = DAEMON_PATHS.LOG_FILE;
+  const meshArgs = [
+    "<string>daemon</string>",
+    "<string>up</string>",
+    "<string>--mesh</string>",
+    `<string>${escapeXml(args.meshSlug)}</string>`,
+    ...args.displayName ? ["<string>--name</string>", `<string>${escapeXml(args.displayName)}</string>`] : []
+  ].join(`
+    `);
+  const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${SERVICE_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escapeXml(args.binaryPath)}</string>
+    ${meshArgs}
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(log2)}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(log2)}</string>
+  <key>WorkingDirectory</key>
+  <string>${escapeXml(homedir6())}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>HOME</key>
+    <string>${escapeXml(homedir6())}</string>
+    <key>PATH</key>
+    <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+  </dict>
+</dict>
+</plist>
+`;
+  writeFileSync9(plist, xml, { mode: 420 });
+  return {
+    platform: "darwin",
+    unitPath: plist,
+    bootCommand: `launchctl bootstrap gui/$(id -u) ${shellQuote(plist)}`
+  };
+}
+function linuxUnitPath() {
+  return join8(homedir6(), ".config", "systemd", "user", SYSTEMD_UNIT);
+}
+function installLinux(args) {
+  const unit = linuxUnitPath();
+  mkdirSync7(dirname5(unit), { recursive: true });
+  const execArgs = [
+    "daemon",
+    "up",
+    "--mesh",
+    args.meshSlug,
+    ...args.displayName ? ["--name", args.displayName] : []
+  ].map(shellQuote).join(" ");
+  const content = `[Unit]
+Description=claudemesh daemon (peer mesh runtime)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${shellQuote(args.binaryPath)} ${execArgs}
+Restart=always
+RestartSec=3
+StandardOutput=append:${DAEMON_PATHS.LOG_FILE}
+StandardError=append:${DAEMON_PATHS.LOG_FILE}
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+
+[Install]
+WantedBy=default.target
+`;
+  writeFileSync9(unit, content, { mode: 420 });
+  return {
+    platform: "linux",
+    unitPath: unit,
+    bootCommand: `systemctl --user daemon-reload && systemctl --user enable --now ${SYSTEMD_UNIT}`
+  };
+}
+function escapeXml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function shellQuote(s) {
+  if (/^[\w@%+=:,./-]+$/.test(s))
+    return s;
+  return "'" + s.replace(/'/g, `'"'"'`) + "'";
+}
+function readInstalledUnit() {
+  const platform5 = detectPlatform();
+  if (!platform5)
+    return { platform: null, path: null, content: null };
+  const path2 = platform5 === "darwin" ? darwinPlistPath() : linuxUnitPath();
+  if (!existsSync12(path2))
+    return { platform: platform5, path: null, content: null };
+  try {
+    return { platform: platform5, path: path2, content: readFileSync9(path2, "utf8") };
+  } catch {
+    return { platform: platform5, path: path2, content: null };
+  }
+}
+var SERVICE_LABEL = "com.claudemesh.daemon", SYSTEMD_UNIT = "claudemesh-daemon.service";
+var init_service_install = __esm(() => {
+  init_paths2();
+});
+
+// src/commands/daemon.ts
+var exports_daemon = {};
+__export(exports_daemon, {
+  runDaemonCommand: () => runDaemonCommand
+});
+async function runDaemonCommand(sub, opts, rest = []) {
+  switch (sub) {
+    case undefined:
+      return printDaemonUsage();
+    case "up":
+    case "start":
+      return runDaemon({
+        tcpEnabled: !opts.noTcp,
+        publicHealthCheck: opts.publicHealth,
+        mesh: opts.mesh,
+        displayName: opts.displayName
+      });
+    case "help":
+    case "--help":
+    case "-h":
+      return printDaemonUsage();
+    case "status":
+      return runStatus(opts);
+    case "version":
+      return runVersion(opts);
+    case "down":
+    case "stop":
+      return runStop(opts);
+    case "accept-host":
+      return runAcceptHost(opts);
+    case "outbox":
+      return runOutbox(rest, opts);
+    case "install-service":
+      return runInstallService(opts);
+    case "uninstall-service":
+      return runUninstallService(opts);
+    default:
+      process.stderr.write(`unknown daemon subcommand: ${sub}
+
+`);
+      printDaemonUsage(process.stderr);
+      return 2;
+  }
+}
+function printDaemonUsage(stream = process.stdout) {
+  stream.write(`claudemesh daemon — long-lived peer mesh runtime (v0.9.0)
+
+USAGE
+  claudemesh daemon <command> [options]
+
+COMMANDS
+  up | start                   start the daemon in the foreground
+  status                       show running pid + IPC health
+  version                      ipc + schema version of the running daemon
+  down | stop                  stop the running daemon (SIGTERM, then wait)
+  accept-host                  pin the current host fingerprint
+  outbox list                  list local outbox rows (newest first)
+  outbox requeue <id>          re-enqueue an aborted / dead outbox row
+  install-service --mesh <s>   write launchd (macOS) / systemd-user (Linux) unit
+  uninstall-service            remove the platform service unit
+
+OPTIONS
+  --mesh <slug>                attach to / target this mesh
+  --name <displayName>         override CLAUDEMESH_DISPLAY_NAME
+  --no-tcp                     disable the loopback TCP listener (UDS only)
+  --public-health              expose /v1/health unauthenticated on TCP
+  --json                       machine-readable output where supported
+
+OUTBOX FLAGS (for 'daemon outbox list')
+  --pending --inflight --done --failed --aborted   filter by status
+
+OUTBOX FLAGS (for 'daemon outbox requeue')
+  --new-client-id <id>         mint the new row with this client_message_id
+
+See ${"https://claudemesh.com/docs"} for the full daemon spec.
+`);
+  return 0;
+}
+async function runOutbox(rest, opts) {
+  const sub = rest[0];
+  switch (sub) {
+    case undefined:
+    case "list": {
+      const status = opts.outboxStatus;
+      const path2 = `/v1/outbox${status ? `?status=${status}` : ""}`;
+      try {
+        const res = await ipc({ path: path2 });
+        if (opts.json) {
+          process.stdout.write(JSON.stringify(res.body) + `
+`);
+          return 0;
+        }
+        if (!res.body.items?.length) {
+          process.stdout.write(`(empty)
+`);
+          return 0;
+        }
+        for (const r of res.body.items) {
+          const tag = r.status.padEnd(8);
+          const bm = r.broker_message_id ? ` → ${r.broker_message_id}` : "";
+          const err = r.last_error ? ` last_error="${r.last_error.slice(0, 60)}"` : "";
+          process.stdout.write(`${tag} ${r.id}  cid=${r.client_message_id}  attempts=${r.attempts}${bm}${err}
+`);
+        }
+        return 0;
+      } catch (err) {
+        process.stderr.write(`daemon unreachable: ${String(err)}
+`);
+        return 1;
+      }
+    }
+    case "requeue": {
+      const id = rest[1];
+      if (!id) {
+        process.stderr.write(`usage: claudemesh daemon outbox requeue <id> [--new-client-id <id>]
+`);
+        return 2;
       }
-      render.section(`reminders (${scheduled.length})`);
-      for (const m of scheduled) {
-        const when = new Date(m.deliverAt).toLocaleString();
-        const to = m.to === client.getSessionPubkey() ? dim("(self)") : m.to;
-        process.stdout.write(`  ${bold(m.id.slice(0, 8))} ${dim("→")} ${to} ${dim("at")} ${when}
+      const newClientMessageId = opts.newClientId;
+      try {
+        const res = await ipc({
+          method: "POST",
+          path: "/v1/outbox/requeue",
+          body: { id, new_client_message_id: newClientMessageId }
+        });
+        if (res.status === 200) {
+          if (opts.json)
+            process.stdout.write(JSON.stringify(res.body) + `
 `);
-        process.stdout.write(`    ${dim(m.message.slice(0, 80))}
-
+          else
+            process.stdout.write(`requeued: aborted ${res.body.aborted_row_id} → new ${res.body.new_row_id} ` + `(client_message_id=${res.body.new_client_message_id})
+`);
+          return 0;
+        }
+        process.stderr.write(`requeue failed (${res.status}): ${res.body.error ?? "unknown"}
+`);
+        return 1;
+      } catch (err) {
+        process.stderr.write(`daemon unreachable: ${String(err)}
 `);
+        return 1;
       }
-    });
-    return;
-  }
-  if (action === "cancel") {
-    const id = positional[1];
-    if (!id) {
-      render.err("Usage: claudemesh remind cancel <id>");
-      process.exit(1);
     }
-    await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
-      const ok = await client.cancelScheduled(id);
-      if (ok)
-        render.ok(`cancelled ${bold(id.slice(0, 8))}`);
-      else {
-        render.err(`not found or already fired: ${id}`);
-        process.exit(1);
-      }
-    });
-    return;
+    default:
+      process.stderr.write(`unknown outbox subcommand: ${sub}
+`);
+      process.stderr.write(`usage: claudemesh daemon outbox [list|requeue <id>]
+`);
+      return 2;
   }
-  const message = action ?? positional.join(" ");
-  if (!message) {
-    render.err("Usage: claudemesh remind <message> --in <duration>");
-    render.info(dim("       claudemesh remind <message> --at <time>"));
-    render.info(dim('       claudemesh remind <message> --cron "0 */2 * * *"'));
-    render.info(dim("       claudemesh remind list"));
-    render.info(dim("       claudemesh remind cancel <id>"));
-    process.exit(1);
+}
+async function runInstallService(opts) {
+  const { installService: installService2, detectPlatform: detectPlatform2 } = await Promise.resolve().then(() => (init_service_install(), exports_service_install));
+  const platform5 = detectPlatform2();
+  if (!platform5) {
+    process.stderr.write(`unsupported platform: ${process.platform}
+`);
+    return 2;
   }
-  const isCron = !!flags.cron;
-  const deliverAt = isCron ? 0 : parseDeliverAt(flags);
-  if (!isCron && deliverAt === null) {
-    render.err("Specify when", 'use --in <duration> (e.g. "2h", "30m"), --at <time> (e.g. "15:00"), or --cron <expression>');
-    process.exit(1);
+  if (!opts.mesh) {
+    process.stderr.write(`pass --mesh <slug> so the service knows which mesh to attach to
+`);
+    return 2;
   }
-  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
-    let targetSpec;
-    if (flags.to && flags.to !== "self") {
-      if (flags.to.startsWith("@") || flags.to === "*" || /^[0-9a-f]{64}$/i.test(flags.to)) {
-        targetSpec = flags.to;
-      } else {
-        const peers = await client.listPeers();
-        const match = peers.find((p) => p.displayName.toLowerCase() === flags.to.toLowerCase());
-        if (!match) {
-          render.err(`Peer "${flags.to}" not found`, `online: ${peers.map((p) => p.displayName).join(", ") || "(none)"}`);
-          process.exit(1);
-        }
-        targetSpec = match.pubkey;
-      }
-    } else {
-      targetSpec = client.getSessionPubkey() ?? "*";
-    }
-    const result = await client.scheduleMessage(targetSpec, message, deliverAt ?? 0, false, flags.cron);
-    if (!result) {
-      render.err("Broker did not acknowledge — check connection");
-      process.exit(1);
-    }
-    if (flags.json) {
-      console.log(JSON.stringify(result));
-      return;
+  let binary = process.argv[1] ?? "";
+  if (!binary || /\.ts$/.test(binary) || /node_modules|src\/entrypoints/.test(binary)) {
+    try {
+      const { execSync: execSync3 } = await import("node:child_process");
+      binary = execSync3("which claudemesh", { encoding: "utf8" }).trim();
+    } catch {
+      process.stderr.write(`couldn't resolve a 'claudemesh' binary on PATH; install via npm/homebrew first
+`);
+      return 1;
     }
-    const toLabel = !flags.to || flags.to === "self" ? "yourself" : flags.to;
-    if (isCron) {
-      const nextFire = new Date(result.deliverAt).toLocaleString();
-      render.ok(`recurring reminder set`, `${result.scheduledId.slice(0, 8)}  ·  ${clay(message)} → ${toLabel}  ·  cron ${flags.cron}  ·  next ${nextFire}`);
+  }
+  try {
+    const r = installService2({
+      binaryPath: binary,
+      meshSlug: opts.mesh,
+      displayName: opts.displayName
+    });
+    if (opts.json) {
+      process.stdout.write(JSON.stringify({ ok: true, ...r }) + `
+`);
     } else {
-      const when = new Date(result.deliverAt).toLocaleString();
-      render.ok(`reminder set`, `${result.scheduledId.slice(0, 8)}  ·  ${clay(message)} → ${toLabel} at ${when}`);
+      process.stdout.write(`installed ${r.platform} service unit: ${r.unitPath}
+`);
+      process.stdout.write(`bring it up now: ${r.bootCommand}
+`);
     }
-  });
+    return 0;
+  } catch (err) {
+    process.stderr.write(`install-service failed: ${String(err)}
+`);
+    return 1;
+  }
 }
-var init_remind = __esm(() => {
-  init_connect();
-  init_render();
-  init_styles();
-});
-
-// src/commands/register.ts
-var exports_register = {};
-__export(exports_register, {
-  register: () => register2
-});
-async function register2() {
-  return login();
+async function runUninstallService(opts) {
+  const { uninstallService: uninstallService2 } = await Promise.resolve().then(() => (init_service_install(), exports_service_install));
+  const r = uninstallService2();
+  if (opts.json)
+    process.stdout.write(JSON.stringify(r) + `
+`);
+  else if (r.removed.length === 0)
+    process.stdout.write(`no service unit installed
+`);
+  else
+    process.stdout.write(`removed: ${r.removed.join(", ")}
+`);
+  return 0;
 }
-var init_register = __esm(() => {
-  init_login();
-});
-
-// src/commands/logout.ts
-var exports_logout = {};
-__export(exports_logout, {
-  logout: () => logout2
-});
-async function logout2() {
+async function runAcceptHost(opts) {
+  const { acceptCurrentHost: acceptCurrentHost2 } = await Promise.resolve().then(() => (init_identity(), exports_identity));
+  const fp = acceptCurrentHost2();
+  if (opts.json)
+    process.stdout.write(JSON.stringify({ ok: true, fingerprint_prefix: fp.fingerprint.slice(0, 16) }) + `
+`);
+  else
+    process.stdout.write(`host fingerprint accepted: ${fp.fingerprint.slice(0, 16)}…
+`);
+  return 0;
+}
+async function runStatus(opts) {
+  const pid = readRunningPid();
+  if (!pid) {
+    if (opts.json)
+      process.stdout.write(JSON.stringify({ running: false }) + `
+`);
+    else
+      process.stdout.write(`daemon: not running
+`);
+    return 1;
+  }
   try {
-    const { revoked } = await logout();
-    if (revoked) {
-      console.log(`  ${green(icons.check)} Revoked session on claudemesh.com`);
+    const res = await ipc({ path: "/v1/health" });
+    if (opts.json) {
+      process.stdout.write(JSON.stringify({ running: true, pid, health: res.body }) + `
+`);
     } else {
-      console.log(`  ${yellow(icons.warn)} Could not revoke session on claudemesh.com.`);
-      console.log(`    Revoke manually at https://claudemesh.com/dashboard/settings/sessions`);
+      process.stdout.write(`daemon: running (pid ${pid})
+`);
+      process.stdout.write(`socket: ${DAEMON_PATHS.SOCK_FILE}
+`);
     }
-    console.log(`  ${green(icons.check)} Removed local credentials.`);
-    return EXIT.SUCCESS;
+    return 0;
   } catch (err) {
-    console.error(`  ${icons.cross} Logout failed: ${err instanceof Error ? err.message : err}`);
-    return EXIT.AUTH_FAILED;
+    if (opts.json)
+      process.stdout.write(JSON.stringify({ running: true, pid, ipc_error: String(err) }) + `
+`);
+    else
+      process.stdout.write(`daemon: pid ${pid} alive but IPC unreachable (${String(err)})
+`);
+    return 1;
   }
 }
-var init_logout = __esm(() => {
-  init_facade6();
-  init_styles();
-  init_exit_codes();
-});
-
-// src/commands/whoami.ts
-var exports_whoami = {};
-__export(exports_whoami, {
-  whoami: () => whoami
-});
-async function whoami(opts) {
-  const result = await whoAmI();
-  if (opts.json) {
-    console.log(JSON.stringify({ schema_version: "1.0", ...result }, null, 2));
-    return result.signed_in || result.local ? EXIT.SUCCESS : EXIT.AUTH_FAILED;
+async function runVersion(opts) {
+  try {
+    const res = await ipc({ path: "/v1/version" });
+    if (opts.json)
+      process.stdout.write(JSON.stringify(res.body) + `
+`);
+    else {
+      const v = res.body;
+      process.stdout.write(`daemon ${v.daemon_version ?? "unknown"} (ipc ${v.ipc_api ?? "?"}, schema ${v.schema_version ?? "?"})
+`);
+    }
+    return 0;
+  } catch (err) {
+    if (err instanceof IpcError) {
+      process.stderr.write(`${err.message}
+`);
+      return err.status === 401 ? 3 : 1;
+    }
+    process.stderr.write(`daemon unreachable: ${String(err)}
+`);
+    return 1;
   }
-  if (!result.signed_in && !result.local) {
-    render.err("Not signed in", "Run `claudemesh login` to sign in or `claudemesh <invite>` to join.");
-    return EXIT.AUTH_FAILED;
+}
+async function runStop(opts) {
+  const pid = readRunningPid();
+  if (!pid) {
+    if (opts.json)
+      process.stdout.write(JSON.stringify({ stopped: false, reason: "not_running" }) + `
+`);
+    else
+      process.stdout.write(`daemon: not running
+`);
+    return 0;
   }
-  render.section("whoami");
-  if (result.signed_in) {
-    render.kv([
-      ["user", `${bold(result.user.display_name)} ${dim(`(${result.user.email})`)}`],
-      ["token", `${result.token_source} ${dim("(~/.claudemesh/auth.json)")}`],
-      ...result.meshes ? [["meshes", `${result.meshes.owned} owned · ${result.meshes.guest} guest`]] : []
-    ]);
-  } else {
-    render.kv([
-      ["web", dim("not signed in · run `claudemesh login` for account features")]
-    ]);
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch (err) {
+    process.stderr.write(`failed to signal pid ${pid}: ${String(err)}
+`);
+    return 1;
   }
-  if (result.local) {
-    render.blank();
-    render.kv([
-      ["local", `${result.local.meshes.length} mesh${result.local.meshes.length === 1 ? "" : "es"} · ${dim(result.local.config_path)}`]
-    ]);
-    for (const m of result.local.meshes) {
-      console.log(`    ${clay("●")} ${bold(m.slug)}  ${dim(`member ${m.member_id.slice(0, 8)}…  pk ${m.pubkey_prefix}…`)}`);
+  for (let i = 0;i < 50; i++) {
+    await new Promise((r) => setTimeout(r, 100));
+    if (!readRunningPid()) {
+      if (opts.json)
+        process.stdout.write(JSON.stringify({ stopped: true, pid }) + `
+`);
+      else
+        process.stdout.write(`daemon: stopped (was pid ${pid})
+`);
+      return 0;
     }
   }
-  render.blank();
-  return EXIT.SUCCESS;
+  if (opts.json)
+    process.stdout.write(JSON.stringify({ stopped: false, pid, reason: "shutdown_timeout" }) + `
+`);
+  else
+    process.stdout.write(`daemon: signaled but did not exit within 5s (pid ${pid})
+`);
+  return 1;
 }
-var init_whoami = __esm(() => {
-  init_facade6();
-  init_render();
-  init_styles();
-  init_exit_codes();
+var init_daemon = __esm(() => {
+  init_run();
+  init_client4();
+  init_lock();
+  init_paths2();
 });
 
 // src/commands/install.ts
@@ -8184,21 +10501,21 @@ __export(exports_install, {
   runInstall: () => runInstall
 });
 import {
-  chmodSync as chmodSync3,
+  chmodSync as chmodSync4,
   copyFileSync,
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync5,
-  writeFileSync as writeFileSync6
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync10,
+  writeFileSync as writeFileSync10
 } from "node:fs";
-import { homedir as homedir6, platform as platform5 } from "node:os";
-import { dirname as dirname3, join as join6, resolve } from "node:path";
+import { homedir as homedir7, platform as platform5 } from "node:os";
+import { dirname as dirname6, join as join9, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function readClaudeConfig() {
-  if (!existsSync7(CLAUDE_CONFIG))
+  if (!existsSync13(CLAUDE_CONFIG))
     return {};
-  const text = readFileSync5(CLAUDE_CONFIG, "utf-8").trim();
+  const text = readFileSync10(CLAUDE_CONFIG, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -8208,12 +10525,12 @@ function readClaudeConfig() {
   }
 }
 function backupClaudeConfig() {
-  if (!existsSync7(CLAUDE_CONFIG))
+  if (!existsSync13(CLAUDE_CONFIG))
     return;
-  const backupDir = join6(dirname3(CLAUDE_CONFIG), ".claude", "backups");
-  mkdirSync4(backupDir, { recursive: true });
+  const backupDir = join9(dirname6(CLAUDE_CONFIG), ".claude", "backups");
+  mkdirSync8(backupDir, { recursive: true });
   const ts = Date.now();
-  const dest = join6(backupDir, `.claude.json.pre-claudemesh.${ts}`);
+  const dest = join9(backupDir, `.claude.json.pre-claudemesh.${ts}`);
   copyFileSync(CLAUDE_CONFIG, dest);
 }
 function patchMcpServer(entry) {
@@ -8237,7 +10554,7 @@ function patchMcpServer(entry) {
   return action;
 }
 function removeMcpServer() {
-  if (!existsSync7(CLAUDE_CONFIG))
+  if (!existsSync13(CLAUDE_CONFIG))
     return false;
   backupClaudeConfig();
   const cfg = readClaudeConfig();
@@ -8250,11 +10567,11 @@ function removeMcpServer() {
   return true;
 }
 function flushClaudeConfig(obj) {
-  mkdirSync4(dirname3(CLAUDE_CONFIG), { recursive: true });
-  writeFileSync6(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
+  mkdirSync8(dirname6(CLAUDE_CONFIG), { recursive: true });
+  writeFileSync10(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
   try {
-    chmodSync3(CLAUDE_CONFIG, 384);
+    chmodSync4(CLAUDE_CONFIG, 384);
   } catch {}
 }
 function bunAvailable() {
@@ -8268,13 +10585,13 @@ function resolveEntry() {
   const here = fileURLToPath(import.meta.url);
   if (isBundledFile(here))
     return here;
-  return resolve(dirname3(here), "..", "index.ts");
+  return resolve(dirname6(here), "..", "index.ts");
 }
 function resolveBundledSkillsDir() {
   const here = fileURLToPath(import.meta.url);
-  const pkgRoot = resolve(dirname3(here), "..", "..");
-  const skillsDir = join6(pkgRoot, "skills");
-  if (existsSync7(skillsDir))
+  const pkgRoot = resolve(dirname6(here), "..", "..");
+  const skillsDir = join9(pkgRoot, "skills");
+  if (existsSync13(skillsDir))
     return skillsDir;
   return null;
 }
@@ -8287,13 +10604,13 @@ function installSkills() {
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const srcDir = join6(src, entry.name);
-    const dstDir = join6(CLAUDE_SKILLS_ROOT, entry.name);
-    mkdirSync4(dstDir, { recursive: true });
+    const srcDir = join9(src, entry.name);
+    const dstDir = join9(CLAUDE_SKILLS_ROOT, entry.name);
+    mkdirSync8(dstDir, { recursive: true });
     for (const file of fs.readdirSync(srcDir, { withFileTypes: true })) {
       if (!file.isFile())
         continue;
-      copyFileSync(join6(srcDir, file.name), join6(dstDir, file.name));
+      copyFileSync(join9(srcDir, file.name), join9(dstDir, file.name));
     }
     installed.push(entry.name);
   }
@@ -8308,8 +10625,8 @@ function uninstallSkills() {
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const dstDir = join6(CLAUDE_SKILLS_ROOT, entry.name);
-    if (existsSync7(dstDir)) {
+    const dstDir = join9(CLAUDE_SKILLS_ROOT, entry.name);
+    if (existsSync13(dstDir)) {
       try {
         fs.rmSync(dstDir, { recursive: true, force: true });
         removed.push(entry.name);
@@ -8334,9 +10651,9 @@ function entriesEqual(a, b) {
   return a.command === b.command && JSON.stringify(a.args ?? []) === JSON.stringify(b.args ?? []);
 }
 function readClaudeSettings() {
-  if (!existsSync7(CLAUDE_SETTINGS))
+  if (!existsSync13(CLAUDE_SETTINGS))
     return {};
-  const text = readFileSync5(CLAUDE_SETTINGS, "utf-8").trim();
+  const text = readFileSync10(CLAUDE_SETTINGS, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -8346,8 +10663,8 @@ function readClaudeSettings() {
   }
 }
 function writeClaudeSettings(obj) {
-  mkdirSync4(dirname3(CLAUDE_SETTINGS), { recursive: true });
-  writeFileSync6(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
+  mkdirSync8(dirname6(CLAUDE_SETTINGS), { recursive: true });
+  writeFileSync10(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
 }
 function installAllowedTools() {
@@ -8361,7 +10678,7 @@ function installAllowedTools() {
   return { added: toAdd, unchanged: CLAUDEMESH_TOOLS.length - toAdd.length };
 }
 function uninstallAllowedTools() {
-  if (!existsSync7(CLAUDE_SETTINGS))
+  if (!existsSync13(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const existing = settings.allowedTools ?? [];
@@ -8396,7 +10713,7 @@ function installHooks() {
   return { added, unchanged };
 }
 function uninstallHooks() {
-  if (!existsSync7(CLAUDE_SETTINGS))
+  if (!existsSync13(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const hooks = settings.hooks;
@@ -8445,7 +10762,7 @@ function runInstall(args = []) {
     render.err("`bun` is not on PATH.", "Install Bun first: https://bun.com");
     process.exit(1);
   }
-  if (!existsSync7(entry)) {
+  if (!existsSync13(entry)) {
     render.err(`MCP entry not found at ${entry}`);
     process.exit(1);
   }
@@ -8496,7 +10813,7 @@ function runInstall(args = []) {
       const installed = installSkills();
       if (installed.length > 0) {
         render.ok(`Claude skill${installed.length === 1 ? "" : "s"} installed`, installed.join(", "));
-        render.info(dim(`  ${join6(CLAUDE_SKILLS_ROOT, installed[0])}/SKILL.md`));
+        render.info(dim(`  ${join9(CLAUDE_SKILLS_ROOT, installed[0])}/SKILL.md`));
       }
     } catch (e) {
       render.warn(`skill install failed: ${e instanceof Error ? e.message : String(e)}`);
@@ -8584,9 +10901,9 @@ var init_install = __esm(() => {
   init_facade();
   init_render();
   init_styles();
-  CLAUDE_CONFIG = join6(homedir6(), ".claude.json");
-  CLAUDE_SETTINGS = join6(homedir6(), ".claude", "settings.json");
-  CLAUDE_SKILLS_ROOT = join6(homedir6(), ".claude", "skills");
+  CLAUDE_CONFIG = join9(homedir7(), ".claude.json");
+  CLAUDE_SETTINGS = join9(homedir7(), ".claude", "settings.json");
+  CLAUDE_SKILLS_ROOT = join9(homedir7(), ".claude", "skills");
   CLAUDEMESH_TOOLS = [
     "mcp__claudemesh__cancel_scheduled",
     "mcp__claudemesh__check_messages",
@@ -8641,35 +10958,35 @@ var exports_uninstall = {};
 __export(exports_uninstall, {
   uninstall: () => uninstall
 });
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync7, existsSync as existsSync8, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
-import { join as join7, dirname as dirname4 } from "node:path";
-import { homedir as homedir7 } from "node:os";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync11, existsSync as existsSync14, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
+import { join as join10, dirname as dirname7 } from "node:path";
+import { homedir as homedir8 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function bundledSkillsDir() {
   const here = fileURLToPath2(import.meta.url);
-  const pkgRoot = join7(dirname4(here), "..", "..");
-  const skillsDir = join7(pkgRoot, "skills");
-  return existsSync8(skillsDir) ? skillsDir : null;
+  const pkgRoot = join10(dirname7(here), "..", "..");
+  const skillsDir = join10(pkgRoot, "skills");
+  return existsSync14(skillsDir) ? skillsDir : null;
 }
 async function uninstall() {
   let removed = 0;
-  if (existsSync8(PATHS.CLAUDE_JSON)) {
+  if (existsSync14(PATHS.CLAUDE_JSON)) {
     try {
-      const raw = readFileSync6(PATHS.CLAUDE_JSON, "utf-8");
+      const raw = readFileSync11(PATHS.CLAUDE_JSON, "utf-8");
       const config = JSON.parse(raw);
       const servers = config.mcpServers;
       if (servers && "claudemesh" in servers) {
         delete servers.claudemesh;
-        writeFileSync7(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
+        writeFileSync11(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
 `, "utf-8");
         render.ok("removed MCP server", dim("~/.claude.json"));
         removed++;
       }
     } catch {}
   }
-  if (existsSync8(PATHS.CLAUDE_SETTINGS)) {
+  if (existsSync14(PATHS.CLAUDE_SETTINGS)) {
     try {
-      const raw = readFileSync6(PATHS.CLAUDE_SETTINGS, "utf-8");
+      const raw = readFileSync11(PATHS.CLAUDE_SETTINGS, "utf-8");
       const config = JSON.parse(raw);
       const hooks = config.hooks;
       if (hooks) {
@@ -8690,7 +11007,7 @@ async function uninstall() {
           }
         }
         if (removedHooks > 0) {
-          writeFileSync7(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
+          writeFileSync11(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
 `, "utf-8");
           render.ok(`removed ${removedHooks} claudemesh hook${removedHooks === 1 ? "" : "s"}`, dim("settings.json"));
           removed++;
@@ -8705,8 +11022,8 @@ async function uninstall() {
       for (const entry of readdirSync2(src, { withFileTypes: true })) {
         if (!entry.isDirectory())
           continue;
-        const dst = join7(CLAUDE_SKILLS_ROOT2, entry.name);
-        if (existsSync8(dst)) {
+        const dst = join10(CLAUDE_SKILLS_ROOT2, entry.name);
+        if (existsSync14(dst)) {
           try {
             rmSync2(dst, { recursive: true, force: true });
             removedSkills.push(entry.name);
@@ -8730,7 +11047,7 @@ var init_uninstall = __esm(() => {
   init_render();
   init_styles();
   init_exit_codes();
-  CLAUDE_SKILLS_ROOT2 = join7(homedir7(), ".claude", "skills");
+  CLAUDE_SKILLS_ROOT2 = join10(homedir8(), ".claude", "skills");
 });
 
 // src/commands/doctor.ts
@@ -8738,9 +11055,9 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync9, readFileSync as readFileSync7, statSync as statSync2 } from "node:fs";
-import { homedir as homedir8, platform as platform6 } from "node:os";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync12, statSync as statSync2 } from "node:fs";
+import { homedir as homedir9, platform as platform6 } from "node:os";
+import { join as join11 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function checkNode() {
   const major = Number(process.versions.node.split(".")[0]);
@@ -8764,8 +11081,8 @@ function checkClaudeOnPath() {
   };
 }
 function checkMcpRegistered() {
-  const claudeConfig = join8(homedir8(), ".claude.json");
-  if (!existsSync9(claudeConfig)) {
+  const claudeConfig = join11(homedir9(), ".claude.json");
+  if (!existsSync15(claudeConfig)) {
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
       pass: false,
@@ -8773,7 +11090,7 @@ function checkMcpRegistered() {
     };
   }
   try {
-    const cfg = JSON.parse(readFileSync7(claudeConfig, "utf-8"));
+    const cfg = JSON.parse(readFileSync12(claudeConfig, "utf-8"));
     const registered = Boolean(cfg.mcpServers?.["claudemesh"]);
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
@@ -8790,8 +11107,8 @@ function checkMcpRegistered() {
   }
 }
 function checkHooksRegistered() {
-  const settings = join8(homedir8(), ".claude", "settings.json");
-  if (!existsSync9(settings)) {
+  const settings = join11(homedir9(), ".claude", "settings.json");
+  if (!existsSync15(settings)) {
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
       pass: false,
@@ -8799,7 +11116,7 @@ function checkHooksRegistered() {
     };
   }
   try {
-    const raw = readFileSync7(settings, "utf-8");
+    const raw = readFileSync12(settings, "utf-8");
     const has = raw.includes("claudemesh hook ");
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
@@ -8815,8 +11132,8 @@ function checkHooksRegistered() {
   }
 }
 function checkConfigFile() {
-  const path = getConfigPath();
-  if (!existsSync9(path)) {
+  const path2 = getConfigPath();
+  if (!existsSync15(path2)) {
     return {
       name: "~/.claudemesh/config.json exists and parses",
       pass: true,
@@ -8825,14 +11142,14 @@ function checkConfigFile() {
   }
   try {
     readConfig();
-    const st = statSync2(path);
+    const st = statSync2(path2);
     const mode = (st.mode & 511).toString(8);
     const secure = platform6() === "win32" || mode === "600";
     return {
       name: "~/.claudemesh/config.json parses + chmod 0600",
       pass: secure,
       detail: platform6() === "win32" ? "chmod skipped on Windows" : `0${mode}`,
-      fix: secure ? undefined : `chmod 600 ${path}`
+      fix: secure ? undefined : `chmod 600 ${path2}`
     };
   } catch (e) {
     return {
@@ -8888,8 +11205,8 @@ async function checkBrokerWs() {
   const wsUrl = URLS.BROKER;
   const start = Date.now();
   try {
-    const WebSocket2 = (await import("ws")).default;
-    const ws = new WebSocket2(wsUrl);
+    const WebSocket3 = (await import("ws")).default;
+    const ws = new WebSocket3(wsUrl);
     const result = await new Promise((resolve2) => {
       const timer = setTimeout(() => {
         try {
@@ -8997,14 +11314,14 @@ var init_doctor = __esm(() => {
 // src/commands/status.ts
 var exports_status = {};
 __export(exports_status, {
-  runStatus: () => runStatus
+  runStatus: () => runStatus2
 });
-import { statSync as statSync3, existsSync as existsSync10 } from "node:fs";
-import WebSocket2 from "ws";
+import { statSync as statSync3, existsSync as existsSync16 } from "node:fs";
+import WebSocket3 from "ws";
 async function probeBroker(url, timeoutMs = 4000) {
   return new Promise((resolve2) => {
     const started = Date.now();
-    const ws = new WebSocket2(url);
+    const ws = new WebSocket3(url);
     const timer = setTimeout(() => {
       try {
         ws.terminate();
@@ -9025,11 +11342,11 @@ async function probeBroker(url, timeoutMs = 4000) {
     });
   });
 }
-async function runStatus() {
+async function runStatus2() {
   render.section(`status (v${VERSION})`);
   const configPath = getConfigPath();
   let configPermsNote = "missing";
-  if (existsSync10(configPath)) {
+  if (existsSync16(configPath)) {
     const mode = (statSync3(configPath).mode & 511).toString(8).padStart(4, "0");
     configPermsNote = mode === "0600" ? `${mode}` : `${mode} — expected 0600`;
   }
@@ -9175,13 +11492,13 @@ var init_check_claude_binary = __esm(() => {
 });
 
 // src/services/health/check-mcp-registered.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync13 } from "node:fs";
 function checkMcpRegistered2() {
   try {
-    if (!existsSync11(PATHS.CLAUDE_JSON)) {
+    if (!existsSync17(PATHS.CLAUDE_JSON)) {
       return { name: "mcp-registered", ok: false, message: "~/.claude.json not found" };
     }
-    const raw = readFileSync8(PATHS.CLAUDE_JSON, "utf-8");
+    const raw = readFileSync13(PATHS.CLAUDE_JSON, "utf-8");
     const config = JSON.parse(raw);
     if (config.mcpServers && "claudemesh" in config.mcpServers) {
       return { name: "mcp-registered", ok: true, message: "MCP server registered" };
@@ -9196,13 +11513,13 @@ var init_check_mcp_registered = __esm(() => {
 });
 
 // src/services/health/check-hooks-registered.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync14 } from "node:fs";
 function checkHooksRegistered2() {
   try {
-    if (!existsSync12(PATHS.CLAUDE_SETTINGS)) {
+    if (!existsSync18(PATHS.CLAUDE_SETTINGS)) {
       return { name: "hooks-registered", ok: false, message: "~/.claude/settings.json not found" };
     }
-    const raw = readFileSync9(PATHS.CLAUDE_SETTINGS, "utf-8");
+    const raw = readFileSync14(PATHS.CLAUDE_SETTINGS, "utf-8");
     const config = JSON.parse(raw);
     if (config.hooks) {
       return { name: "hooks-registered", ok: true, message: "Hooks configured" };
@@ -9217,10 +11534,10 @@ var init_check_hooks_registered = __esm(() => {
 });
 
 // src/services/health/check-config-perms.ts
-import { existsSync as existsSync13, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync19, statSync as statSync4 } from "node:fs";
 function checkConfigPerms() {
   const configFile = PATHS.CONFIG_FILE;
-  if (!existsSync13(configFile)) {
+  if (!existsSync19(configFile)) {
     return { name: "config-perms", ok: true, message: "No config file yet (first run)" };
   }
   try {
@@ -9238,13 +11555,13 @@ var init_check_config_perms = __esm(() => {
 });
 
 // src/services/health/check-keypairs-valid.ts
-import { existsSync as existsSync14, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync15 } from "node:fs";
 function checkKeypairsValid() {
-  if (!existsSync14(PATHS.CONFIG_FILE)) {
+  if (!existsSync20(PATHS.CONFIG_FILE)) {
     return { name: "keypairs-valid", ok: true, message: "No config (first run)" };
   }
   try {
-    const raw = readFileSync10(PATHS.CONFIG_FILE, "utf-8");
+    const raw = readFileSync15(PATHS.CONFIG_FILE, "utf-8");
     const config = JSON.parse(raw);
     const meshes = config.meshes ?? [];
     if (meshes.length === 0) {
@@ -9645,12 +11962,12 @@ var exports_verify = {};
 __export(exports_verify, {
   runVerify: () => runVerify
 });
-import { createHash } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 function safetyNumber(myPubkey, peerPubkey) {
   const a = Buffer.from(myPubkey, "hex");
   const b = Buffer.from(peerPubkey, "hex");
   const [lo, hi] = Buffer.compare(a, b) < 0 ? [a, b] : [b, a];
-  const hash = createHash("sha256").update(lo).update(hi).digest();
+  const hash = createHash3("sha256").update(lo).update(hi).digest();
   const bits = [];
   for (let i = 0;i < 15; i++) {
     for (let b2 = 7;b2 >= 0; b2--) {
@@ -9724,19 +12041,19 @@ var exports_url_handler = {};
 __export(exports_url_handler, {
   runUrlHandler: () => runUrlHandler
 });
-import { platform as platform7, homedir as homedir9 } from "node:os";
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync8, rmSync as rmSync3, chmodSync as chmodSync4 } from "node:fs";
-import { join as join9 } from "node:path";
+import { platform as platform7, homedir as homedir10 } from "node:os";
+import { existsSync as existsSync21, mkdirSync as mkdirSync9, writeFileSync as writeFileSync12, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
+import { join as join12 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function resolveClaudemeshBin() {
   return process.argv[1] ?? "claudemesh";
 }
-function installDarwin() {
+function installDarwin2() {
   const binPath = resolveClaudemeshBin();
-  const appDir = join9(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  const contents = join9(appDir, "Contents");
-  const macOS = join9(contents, "MacOS");
-  mkdirSync5(macOS, { recursive: true });
+  const appDir = join12(homedir10(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  const contents = join12(appDir, "Contents");
+  const macOS = join12(contents, "MacOS");
+  mkdirSync9(macOS, { recursive: true });
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -9759,7 +12076,7 @@ function installDarwin() {
   </array>
 </dict>
 </plist>`;
-  writeFileSync8(join9(contents, "Info.plist"), plist);
+  writeFileSync12(join12(contents, "Info.plist"), plist);
   const shim = `#!/bin/sh
 URL="$1"
 CODE=\${URL#claudemesh://}
@@ -9773,9 +12090,9 @@ tell application "Terminal"
 end tell
 EOF
 `;
-  const shimPath = join9(macOS, "open-url");
-  writeFileSync8(shimPath, shim);
-  chmodSync4(shimPath, 493);
+  const shimPath = join12(macOS, "open-url");
+  writeFileSync12(shimPath, shim);
+  chmodSync5(shimPath, 493);
   const lsreg = spawnSync5("/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister", ["-f", appDir], { encoding: "utf-8" });
   if (lsreg.status !== 0) {
     render.warn("lsregister returned non-zero", "scheme may not activate until Finder rescans.");
@@ -9783,10 +12100,10 @@ EOF
   render.ok("registered claudemesh:// scheme on macOS", dim(appDir));
   return EXIT.SUCCESS;
 }
-function installLinux() {
+function installLinux2() {
   const binPath = resolveClaudemeshBin();
-  const appsDir = join9(homedir9(), ".local", "share", "applications");
-  mkdirSync5(appsDir, { recursive: true });
+  const appsDir = join12(homedir10(), ".local", "share", "applications");
+  mkdirSync9(appsDir, { recursive: true });
   const desktop = `[Desktop Entry]
 Type=Application
 Name=Claudemesh
@@ -9797,8 +12114,8 @@ Terminal=true
 MimeType=x-scheme-handler/claudemesh;
 NoDisplay=true
 `;
-  const desktopPath = join9(appsDir, "claudemesh.desktop");
-  writeFileSync8(desktopPath, desktop);
+  const desktopPath = join12(appsDir, "claudemesh.desktop");
+  writeFileSync12(desktopPath, desktop);
   const xdg1 = spawnSync5("xdg-mime", ["default", "claudemesh.desktop", "x-scheme-handler/claudemesh"], { encoding: "utf-8" });
   if (xdg1.status !== 0) {
     render.warn("xdg-mime not available — skipped mime default registration");
@@ -9820,8 +12137,8 @@ function installWindows() {
     `[HKEY_CURRENT_USER\\Software\\Classes\\claudemesh\\shell\\open\\command]`,
     `@="\\"${binPath.replace(/\\/g, "\\\\")}\\" \\"%1\\""`
   ];
-  const regPath = join9(homedir9(), "claudemesh-handler.reg");
-  writeFileSync8(regPath, lines.join(`\r
+  const regPath = join12(homedir10(), "claudemesh-handler.reg");
+  writeFileSync12(regPath, lines.join(`\r
 `));
   const res = spawnSync5("reg.exe", ["import", regPath], { encoding: "utf-8" });
   if (res.status !== 0) {
@@ -9832,15 +12149,15 @@ function installWindows() {
   return EXIT.SUCCESS;
 }
 function uninstallDarwin() {
-  const appDir = join9(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  if (existsSync15(appDir))
+  const appDir = join12(homedir10(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  if (existsSync21(appDir))
     rmSync3(appDir, { recursive: true, force: true });
   render.ok("removed claudemesh:// handler on macOS");
   return EXIT.SUCCESS;
 }
 function uninstallLinux() {
-  const desktopPath = join9(homedir9(), ".local", "share", "applications", "claudemesh.desktop");
-  if (existsSync15(desktopPath))
+  const desktopPath = join12(homedir10(), ".local", "share", "applications", "claudemesh.desktop");
+  if (existsSync21(desktopPath))
     rmSync3(desktopPath, { force: true });
   render.ok("removed claudemesh:// handler on Linux");
   return EXIT.SUCCESS;
@@ -9855,9 +12172,9 @@ async function runUrlHandler(action) {
   const p = platform7();
   if (act === "install") {
     if (p === "darwin")
-      return installDarwin();
+      return installDarwin2();
     if (p === "linux")
-      return installLinux();
+      return installLinux2();
     if (p === "win32")
       return installWindows();
   } else if (act === "uninstall" || act === "remove") {
@@ -9885,9 +12202,9 @@ var exports_status_line = {};
 __export(exports_status_line, {
   runStatusLine: () => runStatusLine
 });
-import { existsSync as existsSync16, readFileSync as readFileSync11 } from "node:fs";
-import { join as join10 } from "node:path";
-import { homedir as homedir10 } from "node:os";
+import { existsSync as existsSync22, readFileSync as readFileSync16 } from "node:fs";
+import { join as join13 } from "node:path";
+import { homedir as homedir11 } from "node:os";
 async function runStatusLine() {
   try {
     const config = readConfig();
@@ -9895,11 +12212,11 @@ async function runStatusLine() {
       process.stdout.write("◇ claudemesh (not joined)");
       return EXIT.SUCCESS;
     }
-    const cachePath = join10(homedir10(), ".claudemesh", "peer-cache.json");
+    const cachePath = join13(homedir11(), ".claudemesh", "peer-cache.json");
     let cache = {};
-    if (existsSync16(cachePath)) {
+    if (existsSync22(cachePath)) {
       try {
-        cache = JSON.parse(readFileSync11(cachePath, "utf-8"));
+        cache = JSON.parse(readFileSync16(cachePath, "utf-8"));
       } catch {}
     }
     const pick = config.meshes[0];
@@ -9930,7 +12247,7 @@ __export(exports_backup, {
   runRestore: () => runRestore,
   runBackup: () => runBackup
 });
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync9, existsSync as existsSync17 } from "node:fs";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync13, existsSync as existsSync23 } from "node:fs";
 import { createInterface as createInterface11 } from "node:readline";
 function readHidden(prompt5) {
   return new Promise((resolve2) => {
@@ -9972,11 +12289,11 @@ async function deriveKey(pass, salt, s) {
 }
 async function runBackup(outPath) {
   const configPath = getConfigPath();
-  if (!existsSync17(configPath)) {
+  if (!existsSync23(configPath)) {
     console.error("  No config found — nothing to back up. Join a mesh first.");
     return EXIT.NOT_FOUND;
   }
-  const plaintext = readFileSync12(configPath);
+  const plaintext = readFileSync17(configPath);
   const pass = await readHidden("  Passphrase (min 12 chars): ");
   if (pass.length < 12) {
     console.error("  ✗ Passphrase too short.");
@@ -9994,7 +12311,7 @@ async function runBackup(outPath) {
   const ciphertext = Buffer.from(s.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, null, null, nonce, key));
   const blob = Buffer.concat([MAGIC, salt, nonce, ciphertext]);
   const file = outPath ?? `claudemesh-backup-${new Date().toISOString().replace(/[:.]/g, "-")}.cmb`;
-  writeFileSync9(file, blob, { mode: 384 });
+  writeFileSync13(file, blob, { mode: 384 });
   console.log(`
   ✓ Backup saved: ${file}`);
   console.log(`  Size: ${blob.length} bytes. Guard the passphrase — there is no recovery.
@@ -10006,11 +12323,11 @@ async function runRestore(inPath) {
     console.error("  Usage: claudemesh restore <backup-file>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync17(inPath)) {
+  if (!existsSync23(inPath)) {
     console.error(`  ✗ File not found: ${inPath}`);
     return EXIT.NOT_FOUND;
   }
-  const blob = readFileSync12(inPath);
+  const blob = readFileSync17(inPath);
   if (blob.length < 4 + 16 + 24 + 17 || !blob.subarray(0, 4).equals(MAGIC)) {
     console.error("  ✗ Not a claudemesh backup file (bad magic).");
     return EXIT.INVALID_ARGS;
@@ -10029,12 +12346,12 @@ async function runRestore(inPath) {
     return EXIT.INTERNAL_ERROR;
   }
   const configPath = getConfigPath();
-  if (existsSync17(configPath)) {
+  if (existsSync23(configPath)) {
     const backupOld = `${configPath}.before-restore.${Date.now()}`;
-    writeFileSync9(backupOld, readFileSync12(configPath), { mode: 384 });
+    writeFileSync13(backupOld, readFileSync17(configPath), { mode: 384 });
     console.log(`  ↻ Existing config saved to ${backupOld}`);
   }
-  writeFileSync9(configPath, Buffer.from(plaintext), { mode: 384 });
+  writeFileSync13(configPath, Buffer.from(plaintext), { mode: 384 });
   console.log(`
   ✓ Config restored to ${configPath}`);
   console.log("  Run `claudemesh list` to verify your meshes.\n");
@@ -10054,8 +12371,8 @@ __export(exports_upgrade, {
   runUpgrade: () => runUpgrade
 });
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync18 } from "node:fs";
-import { dirname as dirname5, join as join11, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync24 } from "node:fs";
+import { dirname as dirname8, join as join14, resolve as resolve2 } from "node:path";
 async function latestVersion() {
   try {
     const res = await fetch(URLS.NPM_REGISTRY, { signal: AbortSignal.timeout(8000) });
@@ -10068,15 +12385,15 @@ async function latestVersion() {
   }
 }
 function findNpm() {
-  const portable = join11(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
-  if (existsSync18(portable)) {
-    return { npm: portable, prefix: join11(process.env.HOME ?? "", ".claudemesh") };
+  const portable = join14(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
+  if (existsSync24(portable)) {
+    return { npm: portable, prefix: join14(process.env.HOME ?? "", ".claudemesh") };
   }
   let cur = resolve2(process.argv[1] ?? ".");
   for (let i = 0;i < 6; i++) {
-    cur = dirname5(cur);
-    const candidate = join11(cur, "bin", "npm");
-    if (existsSync18(candidate))
+    cur = dirname8(cur);
+    const candidate = join14(cur, "bin", "npm");
+    if (existsSync24(candidate))
       return { npm: candidate };
   }
   return { npm: "npm" };
@@ -10138,9 +12455,9 @@ __export(exports_grants, {
   runBlock: () => runBlock,
   isAllowed: () => isAllowed
 });
-import { existsSync as existsSync19, mkdirSync as mkdirSync6, readFileSync as readFileSync13, writeFileSync as writeFileSync10 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync10, readFileSync as readFileSync18, writeFileSync as writeFileSync14 } from "node:fs";
+import { homedir as homedir12 } from "node:os";
+import { join as join15 } from "node:path";
 async function syncToBroker(meshSlug, grants) {
   const auth = getStoredToken();
   if (!auth)
@@ -10158,19 +12475,19 @@ async function syncToBroker(meshSlug, grants) {
   }
 }
 function readGrants() {
-  if (!existsSync19(GRANT_FILE))
+  if (!existsSync25(GRANT_FILE))
     return {};
   try {
-    return JSON.parse(readFileSync13(GRANT_FILE, "utf-8"));
+    return JSON.parse(readFileSync18(GRANT_FILE, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeGrants(g) {
-  const dir = join12(homedir11(), ".claudemesh");
-  if (!existsSync19(dir))
-    mkdirSync6(dir, { recursive: true });
-  writeFileSync10(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
+  const dir = join15(homedir12(), ".claudemesh");
+  if (!existsSync25(dir))
+    mkdirSync10(dir, { recursive: true });
+  writeFileSync14(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
 }
 function resolveCaps(input) {
   if (input.includes("all"))
@@ -10326,7 +12643,7 @@ var init_grants = __esm(() => {
   BROKER_HTTP7 = URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
   ALL_CAPS = ["read", "dm", "broadcast", "state-read", "state-write", "file-read"];
   DEFAULT_CAPS = ["read", "dm", "broadcast", "state-read"];
-  GRANT_FILE = join12(homedir11(), ".claudemesh", "grants.json");
+  GRANT_FILE = join15(homedir12(), ".claudemesh", "grants.json");
 });
 
 // src/commands/profile.ts
@@ -11223,6 +13540,23 @@ claudemesh send "<from_name>" "..." --mesh "<mesh_slug>"
 
 If the parent Claude session was launched via \`claudemesh launch\`, an MCP push-pipe is running and holds the per-mesh WS connection. CLI invocations dial \`~/.claudemesh/sockets/<mesh-slug>.sock\` and reuse that warm connection (~200ms total round-trip including Node.js startup). If no push-pipe is running (cron, scripts, hooks fired outside a session), the CLI opens its own WS, which takes ~500-700ms cold. **You don't manage this** — every verb auto-detects and falls through.
 
+### Daemon path (v0.9.0, opt-in, fastest)
+
+\`claudemesh daemon up [--mesh <slug>]\` starts a persistent per-user runtime that holds the broker WS, a durable SQLite outbox/inbox, and listens on \`~/.claudemesh/daemon/daemon.sock\` (UDS) plus an optional loopback TCP. When the daemon socket is present, every verb routes through it first (~1ms IPC) before falling back to bridge / cold paths. The send envelope carries a caller-stable \`client_message_id\`, so a \`claudemesh send\` that started before a daemon crash survives the restart via the on-disk outbox.
+
+Lifecycle:
+
+\`\`\`bash
+claudemesh daemon up --mesh <slug>                     # foreground
+claudemesh daemon install-service --mesh <slug>        # macOS launchd / Linux systemd-user
+claudemesh daemon status [--json]                      # health + pid
+claudemesh daemon outbox list [--failed|--pending|...] # local queue inspection
+claudemesh daemon outbox requeue <id>                  # re-enqueue an aborted/dead row
+claudemesh daemon down                                 # SIGTERM + wait
+\`\`\`
+
+\`claudemesh install\` (MCP + hooks registration) and the daemon are independent — install does not start the daemon, and the daemon does not require install. Run both for the warmest path: install gives you the in-session push-pipe, daemon gives you cross-invocation persistence and a survivable outbox.
+
 ## Spawning new sessions (no wizard)
 
 \`claudemesh launch\` is the canonical way to start a new Claude Code session connected to claudemesh. Pass every required flag up front so no interactive prompt fires — that's what makes the verb scriptable from tmux send-keys, AppleScript/iTerm spawn helpers, hooks, cron, and the \`claudemesh launch\` you call from inside another session. **Always use this verb, never \`claude\` directly with hand-rolled flags** — it sets up the per-session ed25519 keypair, exports \`CLAUDEMESH_DISPLAY_NAME\`, isolates the mesh config in a tmpdir, and passes the \`--dangerously-load-development-channels server:claudemesh\` plumbing that the MCP push-pipe needs.
@@ -11805,8 +14139,8 @@ __export(exports_file, {
   runFileGet: () => runFileGet
 });
 import { hostname as osHostname } from "node:os";
-import { resolve as resolvePath, basename, dirname as dirname6 } from "node:path";
-import { statSync as statSync6, existsSync as existsSync20, writeFileSync as writeFileSync11, mkdirSync as mkdirSync7 } from "node:fs";
+import { resolve as resolvePath, basename, dirname as dirname9 } from "node:path";
+import { statSync as statSync6, existsSync as existsSync26, writeFileSync as writeFileSync15, mkdirSync as mkdirSync11 } from "node:fs";
 function emitJson2(data) {
   console.log(JSON.stringify(data, null, 2));
 }
@@ -11823,7 +14157,7 @@ async function runFileShare(filePath, opts) {
     return EXIT.INVALID_ARGS;
   }
   const absPath = resolvePath(filePath);
-  if (!existsSync20(absPath)) {
+  if (!existsSync26(absPath)) {
     render.err(`File not found: ${absPath}`);
     return EXIT.INVALID_ARGS;
   }
@@ -11902,8 +14236,8 @@ async function runFileGet(fileId, opts) {
     }
     const buf = Buffer.from(await res.arrayBuffer());
     const outPath = opts.out ? resolvePath(opts.out) : resolvePath(process.cwd(), meta.name);
-    mkdirSync7(dirname6(outPath), { recursive: true });
-    writeFileSync11(outPath, buf);
+    mkdirSync11(dirname9(outPath), { recursive: true });
+    writeFileSync15(outPath, buf);
     if (opts.json) {
       emitJson2({ fileId, name: meta.name, savedTo: outPath, sizeBytes: buf.length });
     } else {
@@ -11998,7 +14332,7 @@ var require_client = __commonJS((exports) => {
   var ws_1 = __importDefault(__require("ws"));
   var crypto_js_1 = require_crypto();
   var MAX_QUEUED2 = 100;
-  var HELLO_ACK_TIMEOUT_MS2 = 5000;
+  var HELLO_ACK_TIMEOUT_MS3 = 5000;
   var BACKOFF_CAPS2 = [1000, 2000, 4000, 8000, 16000, 30000];
 
   class MeshClient extends node_events_1.EventEmitter {
@@ -12063,7 +14397,7 @@ var require_client = __commonJS((exports) => {
             this.debug("hello_ack timeout");
             ws.close();
             reject(new Error("hello_ack timeout"));
-          }, HELLO_ACK_TIMEOUT_MS2);
+          }, HELLO_ACK_TIMEOUT_MS3);
         };
         const onMessage = (raw) => {
           let msg;
@@ -12513,7 +14847,7 @@ __export(exports_bridge, {
   runBridge: () => runBridge,
   bridgeConfigTemplate: () => bridgeConfigTemplate
 });
-import { readFileSync as readFileSync14, existsSync as existsSync21 } from "node:fs";
+import { readFileSync as readFileSync19, existsSync as existsSync27 } from "node:fs";
 function parseConfig(text) {
   const trimmed = text.trim();
   if (trimmed.startsWith("{"))
@@ -12557,13 +14891,13 @@ async function runBridge(configPath) {
     render.err("Usage: claudemesh bridge run <config.yaml>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync21(configPath)) {
+  if (!existsSync27(configPath)) {
     render.err(`config file not found: ${configPath}`);
     return EXIT.NOT_FOUND;
   }
   let cfg;
   try {
-    cfg = parseConfig(readFileSync14(configPath, "utf-8"));
+    cfg = parseConfig(readFileSync19(configPath, "utf-8"));
   } catch (e) {
     render.err(`failed to parse ${configPath}: ${e instanceof Error ? e.message : String(e)}`);
     return EXIT.INVALID_ARGS;
@@ -12967,9 +15301,9 @@ function cacheKey(apiKeySecret, topicName) {
 async function getTopicKey(args) {
   const cacheId = cacheKey(args.apiKeySecret, args.topicName);
   if (!args.fresh) {
-    const cached = cache.get(cacheId);
-    if (cached)
-      return { ok: true, topicKey: cached.topicKey };
+    const cached2 = cache.get(cacheId);
+    if (cached2)
+      return { ok: true, topicKey: cached2.topicKey };
   }
   let sealed;
   try {
@@ -13533,8 +15867,8 @@ var init_definitions = __esm(() => {
 });
 
 // src/services/bridge/server.ts
-import { createServer as createServer2 } from "node:net";
-import { mkdirSync as mkdirSync8, unlinkSync as unlinkSync2, existsSync as existsSync22, chmodSync as chmodSync5 } from "node:fs";
+import { createServer as createServer3 } from "node:net";
+import { mkdirSync as mkdirSync12, unlinkSync as unlinkSync5, existsSync as existsSync28, chmodSync as chmodSync6 } from "node:fs";
 async function resolveTarget2(client, to) {
   if (to.startsWith("@") || to === "*" || /^[0-9a-f]{64}$/i.test(to)) {
     return { ok: true, spec: to };
@@ -13646,21 +15980,21 @@ function handleConnection(socket, client) {
   socket.on("error", () => {});
 }
 function startBridgeServer(client) {
-  const path = socketPath(client.meshSlug);
+  const path2 = socketPath(client.meshSlug);
   const dir = socketDir();
-  if (!existsSync22(dir)) {
-    mkdirSync8(dir, { recursive: true, mode: 448 });
+  if (!existsSync28(dir)) {
+    mkdirSync12(dir, { recursive: true, mode: 448 });
   }
-  if (existsSync22(path)) {
+  if (existsSync28(path2)) {
     try {
-      unlinkSync2(path);
+      unlinkSync5(path2);
     } catch {}
   }
-  const server = createServer2((socket) => handleConnection(socket, client));
+  const server = createServer3((socket) => handleConnection(socket, client));
   try {
-    server.listen(path);
+    server.listen(path2);
   } catch (err) {
-    process.stderr.write(`[claudemesh] bridge: failed to bind ${path}: ${String(err)}
+    process.stderr.write(`[claudemesh] bridge: failed to bind ${path2}: ${String(err)}
 `);
     return null;
   }
@@ -13669,11 +16003,11 @@ function startBridgeServer(client) {
 `);
   });
   try {
-    chmodSync5(path, 384);
+    chmodSync6(path2, 384);
   } catch {}
   let stopped = false;
   return {
-    path,
+    path: path2,
     stop() {
       if (stopped)
         return;
@@ -13682,12 +16016,12 @@ function startBridgeServer(client) {
         server.close();
       } catch {}
       try {
-        unlinkSync2(path);
+        unlinkSync5(path2);
       } catch {}
     }
   };
 }
-var init_server = __esm(() => {
+var init_server2 = __esm(() => {
   init_protocol();
 });
 
@@ -14258,9 +16592,9 @@ async function startServiceProxy(serviceName) {
     const fetched = await client.getServiceTools(serviceName);
     tools = fetched;
   } catch {
-    const cached = client.serviceCatalog.find((s) => s.name === serviceName);
-    if (cached) {
-      tools = cached.tools;
+    const cached2 = client.serviceCatalog.find((s) => s.name === serviceName);
+    if (cached2) {
+      tools = cached2.tools;
     }
   }
   if (tools.length === 0) {
@@ -14349,11 +16683,11 @@ async function startServiceProxy(serviceName) {
   process.on("SIGINT", shutdown);
 }
 var peerNameCache, peerNameCacheAge = 0, CACHE_TTL_MS = 30000;
-var init_server2 = __esm(() => {
+var init_server3 = __esm(() => {
   init_definitions();
   init_facade();
   init_facade8();
-  init_server();
+  init_server2();
   peerNameCache = new Map;
 });
 
@@ -14369,7 +16703,7 @@ async function runMcp() {
   process.exit(0);
 }
 var init_mcp = __esm(() => {
-  init_server2();
+  init_server3();
 });
 
 // src/commands/hook.ts
@@ -15174,6 +17508,17 @@ Security
   claudemesh backup [file]         encrypt config → portable recovery file
   claudemesh restore <file>        restore config from a backup file
 
+Daemon  (long-lived peer mesh runtime, v0.9.0)
+  claudemesh daemon up             start daemon (alias: start) [--mesh <slug>] [--no-tcp]
+  claudemesh daemon status         show running pid + IPC health [--json]
+  claudemesh daemon down           stop daemon (alias: stop)
+  claudemesh daemon version        ipc + schema version of running daemon
+  claudemesh daemon outbox list    list local outbox rows [--failed|--pending|--inflight|--done]
+  claudemesh daemon outbox requeue <id>   re-enqueue an aborted/dead row [--new-client-id <id>]
+  claudemesh daemon accept-host    pin current host fingerprint
+  claudemesh daemon install-service --mesh <slug>   write launchd / systemd-user unit
+  claudemesh daemon uninstall-service               remove the unit
+
 Setup
   claudemesh install               register MCP server + hooks
   claudemesh uninstall             remove MCP server + hooks
@@ -15470,6 +17815,23 @@ async function main() {
       process.exit(await whoami2({ json: !!flags.json }));
       break;
     }
+    case "daemon": {
+      const { runDaemonCommand: runDaemonCommand2 } = await Promise.resolve().then(() => (init_daemon(), exports_daemon));
+      const sub = positionals[0];
+      const rest = positionals.slice(1);
+      const outboxStatus = flags.failed ? "dead" : flags.pending ? "pending" : flags.inflight ? "inflight" : flags.done ? "done" : flags.aborted ? "aborted" : undefined;
+      const code = await runDaemonCommand2(sub, {
+        json: !!flags.json,
+        noTcp: !!flags["no-tcp"],
+        publicHealth: !!flags["public-health"],
+        mesh: flags.mesh,
+        displayName: flags.name,
+        outboxStatus,
+        newClientId: flags["new-client-id"]
+      }, rest);
+      process.exit(code);
+      break;
+    }
     case "install": {
       const { runInstall: runInstall2 } = await Promise.resolve().then(() => (init_install(), exports_install));
       runInstall2(positionals);
@@ -15490,8 +17852,8 @@ async function main() {
         const { runStatusSet: runStatusSet2 } = await Promise.resolve().then(() => (init_broker_actions(), exports_broker_actions));
         process.exit(await runStatusSet2(positionals[1] ?? "", { mesh: flags.mesh, json: !!flags.json }));
       } else {
-        const { runStatus: runStatus2 } = await Promise.resolve().then(() => (init_status(), exports_status));
-        await runStatus2();
+        const { runStatus: runStatus3 } = await Promise.resolve().then(() => (init_status(), exports_status));
+        await runStatus3();
       }
       break;
     }
@@ -15643,8 +18005,8 @@ async function main() {
           const { runStatusSet: runStatusSet2 } = await Promise.resolve().then(() => (init_broker_actions(), exports_broker_actions));
           process.exit(await runStatusSet2(positionals[2] ?? "", { mesh: flags.mesh, json: !!flags.json }));
         } else {
-          const { runStatus: runStatus2 } = await Promise.resolve().then(() => (init_status(), exports_status));
-          await runStatus2();
+          const { runStatus: runStatus3 } = await Promise.resolve().then(() => (init_status(), exports_status));
+          await runStatus3();
         }
       } else {
         console.error("Usage: claudemesh profile [summary|visible|status]");
@@ -16131,4 +18493,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=5139AEA096A0916B64756E2164756E21
+//# debugId=7D9AD4B3EA7DF68364756E2164756E21